Aliases: W32/[email protected] 
Variants: W95/Hybris.PI.000, Win32:Hybris-9,  I-Worm/Hybris.Plugin, Win32.Hybris.plugin, W95.Hybris.PI.000 

Classification: Malware
Category: Computer Worm

Status: Active & Spreading
Spreading: Fast
Geographical info: Asia, North and South America, and some parts of Europe and Australia
Removal: Hard
Platform: W32
Discovered: 21 Dec 2000
Damage: Low

Characteristics: The W95.Hybris.plugin program is a detection that is genetic for some of the plug-ins that is encrypted, which are particularly downloadable by the worm W95.Hybris.gen.

More details about W95.Hybris.Plugin

The most ordinary plug-ins will display a huge spiral that will cover the desktop of the Windows and then avoids you from utilizing the Windows. Additional plug-in has the same performance but it display solid circle with black color. The plug-ins may create an image that is spiral. Depend on the time and date of the system, starting in 2001 either September 16 or 24, and 0n 59 mins. of each hour, this image will run. Upon running, The plug-in will load OpenGL libraries that were being used to display the spiral image having white or black color. Also the worm registers as service by itself that avoids the course from displaying in the dialog box of the Close Program. The worm infects the executable programs of the DOS.

Once the W95.Hybris.plugin infects the system, the worm W95.Hybris.gen tries to access to the newsgroup of the alt.comp.virus. In case the worm successfully accessed it uploads its plug-ins that is encrypted to the newsgroup. The worm will then go through the header’s subject of the message of this newsgroup, finds for some plug-ins that are attached, and attempts to differentiate a particular format. Subject Header will particularly the edition of the plug-in that is attached. If a latest edition of a particular plug-ins is initiated, the W95.Hybris.plugin will then download the current updates and the module of its behavior. There are numbers of plug-ins that is available with different traits.