EDITORS NOTE: NEW VIRUS ALERT! Not a hoax... another worm type virus and it's for real!

C-Net reports: "Corporations are scrambling to cope with the new data-destroying Worm. "ExploreZip" worm is forcing the shutdown of email systems nationwide." E-Digest reported the "Happy 99 Worm and Melissa to you within a day of these little devils being spotted... now, yesterday "ExploreZip" hit and IT IS EXTREMELY DESTRUCTIVE.

If you receive a zip file (zipped_files.exe) as an attachment, with a message like this:

Hi Recipient Name!

I received your email and I shall send you a reply ASAP. Till then, take a look at the attached zipped docs.

bye

And *you did not request a document from the source*, DO NOT open the attachment! Delete the e-mail... then empty your deleted mail folder. Remember, Melissa sometimes appeared to be a legitimate message from a trusted source, so be careful even if a trusted source sends you a zipped file. Again, if you're not expecting it, delete it immediately! Let the originator know (be nice, they may not know they have the worm/virus), and be careful out there!

Make sure that your virus program is up-to-date.

Products Header

McAfee LATEST .DAT FILE: 4.0 4030

VirusScan -- McAfee's VirusScan is an excellent utility for catching any viruses that may be hiding out in the darkest recesses of your hard drive. Its graphical interface is both visually appealing and intuitive. VirusScan's VShield component can run in the background, allowing you to continue working on other projects while it does its job. VirusScan's on-line help documentation provides useful insight into the program's many options. These options include the ability to configure the level of scanning desired, the ability to keep and/or print an activity log, and several additional user-configurable preferences.

The latest release of VirusScan, Version 4.x, diverges radically from previous releases -- not so much externally as internally. The biggest change is in the virus scanning engine itself. The Dr. Solomon's virus scanning engine is at the heart of VirusScan 4.x, replacing the various engines used in earlier releases of VirusScan. Because the previous scanning engines and the new Dr. Solomon's scanning engine identify and classify viruses in different ways, the virus definition updates (DAT files) for earlier releases of VirusScan will not work on the 4.x releases; conversely, the DAT files for v4.x and above will not work on earlier releases of VirusScan.

The VShield component of VirusScan has also been expanded in the latest release with the addition of three new network- and Internet-specific modules. The new E-Mail Scan module detects viruses in e-mail attachments that are sent over your internal network mail system. The Download Scan module monitors e-mail received over the Internet as well as downloaded files. Finally, the Internet Filter module detects and protects you against hostile Java applets and ActiveX Controls. The filter module can also be used to block access to specific Web sites.

The interface for VShield has been redesigned to group the configuration options for all four of the modules (the three new ones plus the existing System Scan module) and a configuration wizard has been designed to get you up and running quickly with the most common scanning options. The new release also sports a revamped VShield Security module that allows you to protect the individual properties for any VShield module against unauthorized changes.

The most recent releases of VirusScan also support virus detection and removal of polymorphic and macro viruses (including Office97 viruses) using enhanced heuristic scanning technology. Additional features in these releases include ZIP file scanning, an Emergency Disk creation utility, activity log reports, compressed file scanning support (ZIPs, CABs, etc.), and ScanPM (a command-line scanner that operates in protected mode environments like DOS). All in all, VirusScan is arguably the best virus scanner in the industry.

Pros: Easy to use, scans in the background, cool interface, advanced virus scanning engine
Cons: The older releases (v2.5.x) do not remove (or scan) viruses as well as other scanners

New in v3.2.0: Improved Command Line components, more effective cleaning for MS Excel files infected with the Laroux virus, detection of macro viruses in MS Access database files, compressed file scanning support (ZIPs, CABs, etc.), improved detection technology for polymorphic viruses, scanning support for LS-120 floppy drives, Desktop Management Interface (DMI) alerts, scanning support for files embedded within MS Office files and for password-protected MS Word files; v3.2.0 includes the v3108 DAT (August '98); Release Notes

New in v4.0.x: Dr Solomon's virus scanning engine; new VShield System Scan modules -- E-Mail Scan, Internet Filter (detects hostile Java applets and ActiveX Controls), and Download Scan modules; enhanced heuristic scanning technology, revamped VShield Security module, new versions of VirusScan Command Line components, specialized scanners for protecting MAPI-based and cc:Mail e-mail systems; Release Notes

New for June DAT 3206: Detection of 26 and removal of 19 new viruses, including detection and removal for the new W32/EXPLOREZIP.WORM -- the "ExploreZip" worm; complete list
Note: This DAT file will only work with VScan v3.x - do not install it with the new v4.x releases

New for June DAT 4030: Detection of 52 new viruses (bringing total to 44,600+), including detection and removal for the new W32/EXPLOREZIP.WORM -- the "ExploreZip" worm; detects 130 hostile Java classes and 6 hostile ActiveX controls; complete list
Note: This DAT file will only work with VScan v4.x - do not install it with earlier releases

 

W32/ExploreZip.worm

Worm.ExploreZip

Virus Name: Worm.ExploreZip
Aliases: W32.ExploreZip Worm
Infection Length: 210,432 bytes
Area of Infection: Windows System directory, Email Attachments
Likelihood: Common
Detected as of: June 6, 1999
Characteristics: Worm, Trojan Horse

Overview:

Worm.ExploreZip contains a very malicious payload. Worm.ExploreZip utilizes Microsoft Outlook, Outlook Express, and Microsoft Exchange to mail itself out by replying to unread messages in your Inbox. The payload of the worm will destroy any file with the extension .h, .c, .cpp, .asm, .doc, .ppt, or .xls on your hard drive(s), as well as any mapped drives, each time it is executed. The worm will also search the mapped drives for Windows installations and copy itself to the Windows directory, and then modify the WIN.INI file. This will infect systems without e-mail clients. This continues to occur until the worm is removed.

You may receive this worm as a file attachment named "zipped_files.exe". When run, this executable will copy itself to your Windows System directory with the filename "Explore.exe", or your Windows directory with the filename "_setup.exe". The worm modifies your WIN.INI or registry such that the "Explore.exe" file is executed each time you start Windows.

Worm.ExploreZip was first discovered in Israel and submitted to the Symantec AntiVirus Research Center on June 6, 1999.

Technical Description:

Worm.ExploreZip utilizes MAPI commands and Microsoft Outlook/Outlook Express/Microsoft Exchange on Windows 9x and NT systems to propagate itself.

The worm e-mails itself out as an attachment with the filename "zipped_files.exe" in reply to unread messages it finds in your Inbox. Thus, the e-mail message may appear to come from a known e-mail correspondent in response to a previously sent e-mail. The e-mail contains the following text:

Hi  Recipient Name!

I received your email and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs.
bye
or  sincerely Recipient Name

Once the attachment is executed, it may display the following window:

The worm also copies itself to the Windows System (System32 on Windows NT) directory with the filename "Explore.exe" or "_setup.exe", and modifies the WIN.INI file (Windows 9x) or the registry (on Windows NT). This results in the program being executed each time Windows is started. You may find this file under your Windows Temporary directory or your attachments directory, depending on the e-mail client you are using. E-mail clients will often temporarily store e-mail attachments in these directories under different temporary names.

The worm will continue to search through your Inbox as long as it is still running in memory. Thus, any new messages that are received will be replied to in the above manner.

Payload:

In addition, when Worm.ExploreZip is executed, it searches drives C through Z of your computer system and selects a series of files to destroy based on file extensions (including .h, .c, .cpp, .asm, .doc, .xls, .ppt) by calling CreateFile(), and making them 0 bytes long. You may notice extended hard drive activity when this occurs. This can result in non-recoverable data. This payload routine continues to happen while the worm is active on the system. Thus, any newly created files matching the extensions list will be destroyed as well.