manunkind
November 17, 2000, 12:36 am
TROJ_HYBRIS is a new worm, recently reported
in-the-wild. Once an infected file is executed, TROJ_HYBRIS modifies "WSOCK32.DLL" so that it can monitor outgoing mail and also email itself to other users. This happens when messages are being sent with Microsoft Outlook (Filename of the outgoing attachment varies). TROJ_HYBRIS also contains plug-in functionality, which allows it to change its behavior. As of November 15th, we have seen many variants of this worm, including numerous plug-ins. Plug-ins
are automatically downloaded by the worm from a Web site (which has been deleted by the ISP) and from the Usenet group "alt.comp.virus."
For additional information about TROJ_HYBRIS, please refer to our Web site at: http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=TROJ_HYBRIS
TROJ_HYBRIS and its different variants are detected with Trend Pattern #797 and above.
in-the-wild. Once an infected file is executed, TROJ_HYBRIS modifies "WSOCK32.DLL" so that it can monitor outgoing mail and also email itself to other users. This happens when messages are being sent with Microsoft Outlook (Filename of the outgoing attachment varies). TROJ_HYBRIS also contains plug-in functionality, which allows it to change its behavior. As of November 15th, we have seen many variants of this worm, including numerous plug-ins. Plug-ins
are automatically downloaded by the worm from a Web site (which has been deleted by the ISP) and from the Usenet group "alt.comp.virus."
For additional information about TROJ_HYBRIS, please refer to our Web site at: http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=TROJ_HYBRIS
TROJ_HYBRIS and its different variants are detected with Trend Pattern #797 and above.