EDITORS NOTE: NEW VIRUS ALERT! Not a hoax... another worm type virus and it's for real! C-Net reports: "Corporations are scrambling to cope with the new data-destroying Worm. "ExploreZip" worm is forcing the shutdown of email systems nationwide." E-Digest reported the "Happy 99 Worm and Melissa to you within a day of these little devils being spotted... now, yesterday "ExploreZip" hit and IT IS EXTREMELY DESTRUCTIVE. If you receive a zip file (zipped_files.exe) as an attachment, with a message like this: Hi Recipient Name! I received your email and I shall send you a reply ASAP. Till then, take a look at the attached zipped docs. bye And *you did not request a document from the source*, DO NOT open the attachment! Delete the e-mail... then empty your deleted mail folder. Remember, Melissa sometimes appeared to be a legitimate message from a trusted source, so be careful even if a trusted source sends you a zipped file. Again, if you're not expecting it, delete it immediately! Let the originator know (be nice, they may not know they have the worm/virus), and be careful out there! Make sure that your virus program is up-to-date.
|
Worm.ExploreZip
Overview: Worm.ExploreZip contains a very malicious payload. Worm.ExploreZip utilizes Microsoft Outlook, Outlook Express, and Microsoft Exchange to mail itself out by replying to unread messages in your Inbox. The payload of the worm will destroy any file with the extension .h, .c, .cpp, .asm, .doc, .ppt, or .xls on your hard drive(s), as well as any mapped drives, each time it is executed. The worm will also search the mapped drives for Windows installations and copy itself to the Windows directory, and then modify the WIN.INI file. This will infect systems without e-mail clients. This continues to occur until the worm is removed. You may receive this worm as a file attachment named "zipped_files.exe". When run, this executable will copy itself to your Windows System directory with the filename "Explore.exe", or your Windows directory with the filename "_setup.exe". The worm modifies your WIN.INI or registry such that the "Explore.exe" file is executed each time you start Windows. Worm.ExploreZip was first discovered in
Israel and submitted to the Symantec AntiVirus Research
Center on June 6, 1999. Worm.ExploreZip utilizes MAPI commands and Microsoft Outlook/Outlook Express/Microsoft Exchange on Windows 9x and NT systems to propagate itself. The worm e-mails itself out as an attachment with the filename "zipped_files.exe" in reply to unread messages it finds in your Inbox. Thus, the e-mail message may appear to come from a known e-mail correspondent in response to a previously sent e-mail. The e-mail contains the following text: Hi Recipient Name! Once the attachment is executed, it may display the
following window:
The worm also copies itself to the Windows System (System32 on Windows NT) directory with the filename "Explore.exe" or "_setup.exe", and modifies the WIN.INI file (Windows 9x) or the registry (on Windows NT). This results in the program being executed each time Windows is started. You may find this file under your Windows Temporary directory or your attachments directory, depending on the e-mail client you are using. E-mail clients will often temporarily store e-mail attachments in these directories under different temporary names. The worm will continue to search through your Inbox as long as it is still running in memory. Thus, any new messages that are received will be replied to in the above manner. Payload: In addition, when Worm.ExploreZip is executed, it searches drives C through Z of your computer system and selects a series of files to destroy based on file extensions (including .h, .c, .cpp, .asm, .doc, .xls, .ppt) by calling CreateFile(), and making them 0 bytes long. You may notice extended hard drive activity when this occurs. This can result in non-recoverable data. This payload routine continues to happen while the worm is active on the system. Thus, any newly created files matching the extensions list will be destroyed as well. |