ALGENEVA-L Archives

From: <>
Subject: Fwd: [GAGEN-L] Virus warning = the REAL thing
Date: Tue, 15 Jun 1999 12:09:59 EDT

--part1_384ed9a9.2497d4d7_boundary
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

--part1_384ed9a9.2497d4d7_boundary
Content-Type: message/rfc822
Content-Disposition: inline

Return-Path: <>
Received: from rly-zb02.mx.aol.com (rly-zb02.mail.aol.com [172.31.41.2]) by
air-zb04.mail.aol.com (v59.34) with SMTP; Fri, 11 Jun 1999 09:38:57
-0400
Received: from bl-14.rootsweb.com (bl-14.rootsweb.com [204.212.38.30])
by rly-zb02.mx.aol.com (8.8.8/8.8.5/AOL-4.0.0)
with ESMTP id JAA06858;
Fri, 11 Jun 1999 09:38:52 -0400 (EDT)
Received: (from )
by bl-14.rootsweb.com (8.9.3/8.9.3) id GAA05174;
Fri, 11 Jun 1999 06:38:28 -0700 (PDT)
Resent-Date: Fri, 11 Jun 1999 06:38:28 -0700 (PDT)
Message-Id: <>
X-Sender:
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Fri, 11 Jun 1999 09:32:05 -0400
Old-To:
From: Tim Stowell <>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Subject: [GAGEN-L] Virus warning = the REAL thing
Resent-Message-ID: <>
To:
Resent-From:
X-Mailing-List: <> archive/latest/498
X-Loop:
Precedence: list
Resent-Sender:
Content-Transfer-Encoding: 7bit

There is a new virus, "Worm.Explore", which is transmitted through an email
attachment and which is very dangerous.

If you receive an email which has the attachment "zipped_files.exe" DO NOT
DOUBLE CLICK ON THIS FILE TO RUN IT. It will destroy vital files on your
hard drive and on the network.

If you have already run this file, do not turn your computer off. Call
tech support at once for help.

A more detailed description is below.

HOW WORM.EXPLORE WORKS
The worm -- first discovered in Israel -- enters as an email attachment
with the name "zipped_files.exe." Its deceptively friendly message reads:

Hi "name of recipient"!
I received your e-mail and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs.
Bye.

Experts say you should delete it without opening it, and then empty the
deleted items file.

If it executes, the worm copies itself to the windows system directory with
the filename "Explore.exe" and then modifies the WIN.INI file so the
program executes each time Windows starts.

It then uses the infected computer's email client to harvest email
addresses in order to propagate itself.

But behind the scenes, it plays real mean: searching C through Z drives and
selecting crucial file extensions and rendering them useless by making them
0 bytes long. Result: Non-recoverable data or computer system failure.

==== GAGEN Mailing List ====
Have you added something signifigant to your website? Advertise it on this
list!

--part1_384ed9a9.2497d4d7_boundary--

This thread:

• Fwd: [GAGEN-L] Virus warning = the REAL thing by <>