FW: Worm.ExplorerZip

> The following information has to do with a new virus. We believe this virus > is responsible for bringing down basically the entire Boston area. > > Worm.ExploreZip is a worm that contains a malicious payload. The worm > utilizes MAPI commands and Microsoft Outlook on Windows systems to > propagate itself. Worm.ExploreZip was first discovered in Israel and > submitted to the Symantec AntiVirus Research Center on June 6, 1999. > The worm e-mails itself out as an attachment with the filename > "zipped_files.exe". The body of the e-mail message may appear to come from > a known e-mail correspondent, and contains the following text: > > Hi Receipient Name! > I received your email and I shall send you a reply ASAP. > Till then, take a look at the attached zipped docs. > bye > > The worm determines whom to mail this message to by going through your > received messages in your Inbox. > Once the attachment is executed, it may display the following window: > The worm then proceeds to copy itself to the c:\\windows\\system directory > with the filename "Explore.exe", and then modifies the WIN.INI file so the > program is executed each time Windows is started. The worm then utilizes > your e-mail client to harvest e-mail addresses in order to propagate itself. > You > may notice your e-mail client start when this occurs. > > Payload: > In addition, when Worm.ExploreZip is executed, it searches drives C through > Z of your computer system and selects a series of files to destroy based on > file > extensions (including .h, .c, .cpp, .asm, .doc, .xls, .ppt) by making them 0 > bytes long. This can result in non-recoverable data. > >