GAMITCHE-L Archives

Archiver > GAMITCHE > 1999-06 > 0929135414


From: "Mitchell CO., GAGenWeb Project" <>
Subject: [GAMITCHE-L] IMPORTANT VIRUS ALERT: ExplorerZip.Worm
Date: Fri, 11 Jun 1999 17:10:14 -0400


Please be aware of a new virus, ExplorerZip.worm, which is purported to be
similar to the recent Melissa virus, only more destructive. There have been
at least two incidences of the virus being sent through emails containing
the subject line:

RE: [GAMITCHE-L] Mitchell County, GAGenWeb

The virus, technically referred to as "worm," is transmitted via an email
attachment named "zipped_files.exe," and is potentially very dangerous.

If you receive an email which has the attachment, DO NOT DOUBLE CLICK ON
THIS FILE TO RUN IT. It will destroy vital files on your hard drive.

If you have already run this file, do not turn your computer off. Call
tech support at once for help.

A more detailed description is below.

HOW EXPLOREZIP.WORM WORKS
The worm -- first discovered in Israel -- enters as an email attachment
with the name "zipped_files.exe." Its deceptively friendly message reads:

Hi "name of recipient"!
I received your e-mail and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs.
Bye.

Experts say you should delete it without opening it, and then empty the
deleted items file.

If it executes, the worm copies itself to the windows system directory with
the filename "Explore.exe" and then modifies the WIN.INI file so the
program executes each time Windows starts.

It then uses the infected computer's email client to harvest email
addresses in order to propagate itself.

Behind the scenes, this worm wreaks havoc on the infected machine. It
searches drives C through Z drives selecting crucial file extensions and
rendering them useless. It erases the content and leaves the files 0 bytes
long. Result: Non-recoverable data or computer system failure.

FOR MORE INFO REGARDING DETECTION & REMOVAL:

McAfee info on virus ExploreZip.worm:
http://vil.mcafee.com/vil/vpe10183.asp

Network Associates details on ExploreZip.worm:
http://www.avertlabs.com/public/datafiles/valerts/vinfo/va10185.asp

-
Karyn Crosson Burke
Mitchell County, GAGenWeb Project Coordinator
URL: http://www.rootsweb.com/~gamitche/
E-MAIL:
ICQ WWPager: http://wwp.mirabilis.com/19611

This thread: