Virsu Alert

“Hi hi kids. I just received an email with a subject line that had something to do with Snowwhite from hahaha@sexyfun.net. I replied to the email asking the sender to remove me from their mailing list and got an instant reply saying that the attachment to the original email had a virus in it. I don't think I'm infected, we'll see. I just wanted to give all of you a heads up on this.”

“i HATE those damned VIRSU!!!”

“they never go away!”

“your virsu are belong to us.”

“You got a virus from Snowwhite@sexyfun.net?

Man, you're dead, viruses dont' respond to anibiotics.”

“Here is a clue to anyone who gets a virus alert email. Forwarding these emails to everyone in your address book is the surest way to spread a virus.

I recommend www.sophos.com

These guys are the virus killers.”

“Here's a copy of the reply I got.

+-------------------
| Please read this whole email as it contains information that can
| be used to protect your computer from a Virus that is spreading
| around the internet.
|
|NOTA BENE: This message is automatically generated; PLEASE DO NOT REPLY.
| Subsequent email with the same reply-to address should not
| induce additional responses from this service.
+---------

Hello,

You are receiving this message because an email, which contained
your email address as the return / reply-to address, was sent to
hahaha@sexyfun.net. This is a list of possible reasons why you received
this message.

1) You sent an email to hahaha@sexyfun.net to request, complain or notify
this user that they are SPAMMING, sending an email with a virus,
sending an email that has content that may not be appropriate for
minors, to be removed from a mailing list, etc..

2) Someone else sent an email to hahaha@sexyfun.net and they are using
your email address as their return / reply-to address. If this is
the case we are sorry that this email was sent to you but please
do read it as it does contain information about a virus that is
spreading around the Internet that we are trying to stop / slow
down.

3) You may already be infected with the computer virus for which this
email is trying to inform you of. This virus (W32.Hybris.gen)
will send a copy of itself to the reply-to address of any incoming
emails that a infected computer receives. So when you received
another copy of the "SPAM" that this virus sends out from another
infected computer, the virus sends a copy of itself to
hahaha@sexyfun.net since hahaha@sexyfun.net is the reply-to address
of the "SPAM" the virus sends out.

4) Your anti-virus software sent an email back to hahaha@sexyfun.net to
inform them that the email they sent to you contains a virus. Most
of the time this email is sent without you knowing by the anti-virus
software itself.

5) Someone has subscribed the email address hahaha@sexyfun.net to a mailing
that you do subscribe to. Our program that sends out this message tries
to make sure that it is not responding to any emails that it receives
from a list server by checking the full email headers for list
information. Some lists do not provide any keys in their full email
headers that we can use to keep the our program from responding. If you
think this is the case please contact your list admin and have them
remove hahaha@sexyfun.net from their member list. Thanks.

6) The above 5 reasons are the most common but their could be others. In
any case this auto responder message is only triggered when an email is
sent to hahaha@sexyfun.net and that email contains your email address
as the return / reply-to address. Do note that our auto responder should
only send this message once to any given email address.

The truth about this "SPAM" that contains Snowwhite in the Subject, is
that a virus called W32.Hybris.gen sends out these emails with attachments
that are also infected with this virus from an already infected computer
in hopes to infect more computers. The Hybris.gen virus will use the
computers it infects to collect email addresses by sniffing Internet
traffic to and from the infected computer. It will then send a copy of the
Snowwhite email to the email addresses it has collected. These emails the
virus sends out use a fake / spoofed FROM: address of hahaha@sexyfun.net
to hide its origin.

We registered the domain sexyfun.net 3-4 months after the Hybris.gen
virus was first discovered in order to setup a web site and provide the
people of the Internet information about this virus as well as tips on how
to detect, clean, trace and protect yourself from this virus, etc...

Here is a list of other facts that may answer some of your questions
that you may have already.

1) We do NOT maintain any mailing lists on our system.
2) This user (hahaha) does NOT exist on our system.
3) The email that you got with the From: field of hahaha@sexyfun.net
did NOT come from sexyfun.net, the hosting company (slowmoe.com) or
the network that our servers sit on. This email address was
FAKED / SPOOFED.
4) The email you got is in FACT a way for the (W95.Hybris.gen) virus
to spread itself around the world / Internet like the ILOVEYOU
virus of a few months past.
5) If you would look at the Received: line of the FULL email header, it
will tell you the real IP / Computer name that has sent you this
virus, which is most likely someone you know that is infected with
the virus and is not aware of it.
6) The owner of the domain sexyfun.net and the hosting company
(slowmoe.com) has setup a help page with information about the
(W95.Hybris.gen) virus, links to software that you can use to clean
your computer if you are infected as well as other misc. information.
7) We did NOT create the virus or know who the person is that created
the virus. We are NOT affiliated with this person / persons and the
same applies to our hosting company.

NOTE: As long as you don't run / open / double click on the attachment
of this email, this virus should not be able to infect you just
by reading the email.

Here are links to well known companies of anti-virus products that
will show that what has been said above is true.

http://www.f-secure.com/v-descs/hybris.shtml
http://www.kaspersky.com/news.asp?tnews=0&nview=1&id=134&page=0

This is the link to the web site we have setup to provide additional
information about this Virus.

http://www.sexyfun.net/ (this is not a adult site of any type)

If have any questions about this, our contact information is located on
our web site ( http://www.sexyfun.net/ )

Thanks you for your time.

-----
NOTE: Any replies sent to this email are not viewed by us. Please use
our contact information located on our site. Thanks.”

“quit hanging out at porn sites.”

“I got the same email but when I tried to open it thinking it was a joke fwd. from a friend my virus detector would not let me open it”

“Oldie I got that one too a few months ago, then my ICQ was messed up”

“Good move Oldie, now you have infected TT!”

“Does the virsu cause dwarfism?”

“I think it does. How bout it tea?”

“Sounds like a social disease.”

“the curse of SHARU VIRSU!!!!”

“Is that Polish Latin?”

“no, it's latin polish. it will make your latin very shiny.”

“A good habit to get into is to NOT reply to spam.”

“aww, come on. SPAM ain't that bad!”

“A bit of advice if you don't know the sender, Delete it asap. Update your virus detector more often.

And remember to always wear your jimmy when going into unknown regions. You just never know if the well has been spoiled.”

“You have no chance to survive make your time.
Ha Ha Ha Ha”

“D'oh, I guess I'll just go crazy while I can.”