Histonetters,

There's another email worm on loose. Please be careful before opening any
attached files you might receive in email. Note that this worm deletes
files on your hard drive.

>From the US Dept of Energy Computer Incident Advisory Capability web site:
http://ciac.llnl.gov/

Phil

>
>
>Update on W32/Explorezip.worm or Worm.ExplorZip 6/10/99
>
>       CIAC has received reports of a new worm that spreads in a
>       manner simular to the 'W97M.Melissa' virus.  The name of
>       this worm is W32/Explorerzip.worm or Worm.ExplorZip.
>
>       The worm is an executable program named "zipped_files.exe"
>       that arrives as an attachment to an e-mail message. It
>       propagates itself by reading the return addresses from mail
>       messages in your inbox and then sending itself as an
>       attachment to those addresses. The body of the e-mail says:
>
>           Hi <recipient>!
>
>           I received your email and I shall send you a
>           reply ASAP.
>
>           Til then, take a look at the attached zipped
>           docs.
>
>           bye
>
>       The worm installs itself as C:\windows\system\explore.exe
>       and places a line in the win.ini file to run the worm every
>       time you start windows.
>
>       The worm has a payload that searches all your hard drives and
>       deletes files with the following file extensions:
>
>       .h  .c  .cpp  .asm  .doc  .xls  .ppt
>
>       Note that these are programmers source code files and Microsoft
>       Office document files.
>
>       Please remind your users not to open attachments that they
>       are unfamiliar with.  Please reference the CIAC bulletin
>         J-037A: W97M.Melissa Word Macro Virus
>         http://www.ciac.org/ciac/bulletins/j-037.shtml
>       for information on how to protect your system.
>
>       More information will follow as CIAC learns more about this
>       virus. Symantec and Network Associates have updated their virus
>       files to include this latest worm.
>
>       Symantec
>       http://www.symantec.com/avcenter/venc/data/worm.explore.zip.html
>
>       McAfee
>       http://vil.mcafee.com/vil/vpe10183.asp

****be famous! send in a tech tip or question***
Philip Oshel
Technical Editor, Microscopy Today
PO Box 620068
Middleton, WI  53562
Address for courier deliveries:
6319 Pheasant Lane  #A-12
Voice: (608) 833-2885
Fax: (608) 836-1969 (please make sure my name is on any fax)
oshel@terracom.net