Eek -- hahaha/snow white/etc.

[Carl Zager]

Donald,

You did the right thing.

The header lines are random, but according to Symantec/Norton,
http://service1.symantec.com/sarc/sarc.nsf/html/W95.Hybris.gen.html, it's
W95.Hybris.gen, and the body refers to "Snow White and the Seven dwarves."
The attachment is always an EXE (executable) or SCR (script). Some of the
names are: anpo porn(.scr, atchim.exe, branca de neve.scr, dunga.scr,
dwarf4you.exe, enano porno.exe, joke.exe, midgets.scr, sexy virgin.scr.

"Hahaha" has "spoofed" the return address on the virus so there is no way
to track him/her back to a provider. Plus, the virus itself is mailed to
the infected person's mailling list (if they are using a Microsoft product
-- Outlook, Outlook Express -- with the addressbook on the local
workstation). 99% of the time the sender doesn't even know his list has
been co-opted.

On Sun, 21 Jan 2001, Donald Galt wrote:

> Somebody sent me the Hahaha virus today. After all the talk, it
> was chilling to finally encounter it on my own doorstep. I deleted
> the message so quickly that I can't remember what the title may
> have been, but do know it wasn't something that struck me as
> spam when I was previewing the headers. Take care, folks!
>
> Don
>

 Carl Zager						KB9RVB
 czager at bloomington.in.us         http://www.mccsc.edu/~czager