The Computer Guys
Miami to Fort Lauderdale Since 1994 - Thank You!
|
|
The Computer Guys Miami to Fort Lauderdale Since 1994 - Thank You!
|
|
|
|
|
We Build the Best & Repair the Rest! © |
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
  
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
Top 10 malware reported to Sophos in December 1999
This section helps you to understand how it behaves
W32/ExploreZip is an email worm which uses Microsoft Outlook to distribute multiple copies of itself. Other MAPI compliant browsers may also propagate the worm. Machines not running Outlook can still be infected with W32/ExploreZip.
If you run the worm when Outlook is active, it mails a copy of itself in reply to all unread mail in your inbox in a message containing the text: Hi <Name Of Recipient> I have received your email and I shall send you a reply ASAP. Till then take a look at the attached zipped docs. bye.
A file called ZIPPED_FILES.EXE is attached, and contains the worm.
If the recipient double-clicks on the attachment, the worm is triggered on their computer. As a disguise, it displays the message: "Cannot open file: it does not appear to be a valid archive. If this file is part of a ZIP format backup set, insert the last disk of the backup set and try again. Please press F1 for help."
The worm then copies itself into the system directory under the name EXPLORE.EXE, and modifies the WIN.INI file so that the infected file runs every time Windows is started.
As an additional warhead, W32/ExploreZip reduces to zero length files of extension ASM, CPP, DOC, XLS, C, H and PPT in any accessible drive. W32/ExploreZip searches all accessible network drives for other installations of Windows 95/98. The worm will install a file called _SETUP.EXE and make a change to WIN.INI so that is run next time the remote copy of Windows 95/98 is started.
If installations of Windows NT are found during the search of network drives W32/ExploreZip will install the _SETUP.EXE file and make the change to WIN.INI, but the file will not be run when the Windows NT machine is restarted. _SETUP.EXE would need to be run manually on the remote machine to apply its registry changes and become active.
If remote Windows installations are affected in this way you should delete the _SETUP.EXE and adjust the WIN.INI and registry accordingly.
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
Copyright © 1998 The Computer Guys |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
   |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
