CIAC email worm announcement

<< Previous Message | Next Message >> (Philip Oshel)
Date:Fri, 11 Jun 1999 08:12:36 -0500
Content-Type:text/plain; charset="us-ascii"


There's another email worm on loose. Please be careful before opening any
attached files you might receive in email. Note that this worm deletes
files on your hard drive.

>From the US Dept of Energy Computer Incident Advisory Capability web site:


>Update on W32/Explorezip.worm or Worm.ExplorZip 6/10/99
>       CIAC has received reports of a new worm that spreads in a
>       manner simular to the 'W97M.Melissa' virus.  The name of
>       this worm is W32/Explorerzip.worm or Worm.ExplorZip.
>       The worm is an executable program named "zipped_files.exe"
>       that arrives as an attachment to an e-mail message. It
>       propagates itself by reading the return addresses from mail
>       messages in your inbox and then sending itself as an
>       attachment to those addresses. The body of the e-mail says:
>           Hi <recipient>!
>           I received your email and I shall send you a
>           reply ASAP.
>           Til then, take a look at the attached zipped
>           docs.
>           bye
>       The worm installs itself as C:\windows\system\explore.exe
>       and places a line in the win.ini file to run the worm every
>       time you start windows.
>       The worm has a payload that searches all your hard drives and
>       deletes files with the following file extensions:
>       .h  .c  .cpp  .asm  .doc  .xls  .ppt
>       Note that these are programmers source code files and Microsoft
>       Office document files.
>       Please remind your users not to open attachments that they
>       are unfamiliar with.  Please reference the CIAC bulletin
>         J-037A: W97M.Melissa Word Macro Virus
>       for information on how to protect your system.
>       More information will follow as CIAC learns more about this
>       virus. Symantec and Network Associates have updated their virus
>       files to include this latest worm.
>       Symantec
>       McAfee

****be famous! send in a tech tip or question***
Philip Oshel
Technical Editor, Microscopy Today
PO Box 620068
Middleton, WI  53562
Address for courier deliveries:
6319 Pheasant Lane  #A-12
Voice: (608) 833-2885
Fax: (608) 836-1969 (please make sure my name is on any fax)

<< Previous Message | Next Message >>