Biblical Hebrew Forum

["Matthew Anstey" <manstey AT portal.ca>]

Gday all,

With the millenium approaching there is in increase of particularly
malicious viruses appearing. McAfee have just released information on
an extremely dangerous email virus (or 'worm') that is spreading at a
very fast rate. I've copied their exact message for you to see. It
reminds us all never to open an executable attachment. Note, that this
worm will come most likely from someone you know, since it replies
automatically from an infected computer.

Virus Email Notification

Please complete the form below to send information about
W32/ExploreZip.worm.pak to a friend.

Virus Characteristics
This is a 32bit Worm that travels by sending email messages to users.
It drops the file explore.exe and modifies either the WIN.INI (Win9x)
or modifies the registry (WinNT).

Information:
This worm attempts to invoke the MAPI aware email applications as in
MS Outlook, MS Outlook Express and MS Exchange. This worm replies to
messages received by sending an an email message with the following
body:

"I received your email and I shall send you a reply ASAP. Till then,
take a look at the attached zipped docs. "

The subject line is not constant as the message is a reply to a
message sent to the infected user. The worm (named "zipped_files.exe"
as the attachment, with a file size of 120,495 bytes (with
compression). The file has a Winzip icon which is designed to fool
unsuspecting users to run it as a self-extracting file. User who run
this attachment will be presented with a fake error message that says:

"Cannot open file: it does not appear to be a valid archive. If this
file is part of a ZIP format backup set, insert the last disk of the
backup set and try again. Please press F1 for help."

Payload Notice
This worm has a payload. Immediately after execution it will search
all local drives for the following files types .c, .cpp, .h, .asm,
.doc, .xls, or .ppt. When found, they are opened for write and
immediately closed leaving them with a zero byte count. Approximately
30 minutes after infection this process is repeated.

This worm will locate systems drives which are NOT mapped drives using
functions from MPR.DLL and Network Neighborhood! On these systems, the
WIN.INI is modified with a run statement to load a file called
_SETUP.EXE from the Windows path, and the file _SETUP.EXE is copied to
the Windows path. These systems will become infected when restarted.
This worm will only try to such systems once, whereas systems which
are mapped drives are constantly attempted to re-infect. Secondly, a
machine infected via another share will switch between _setup and
explore per reboot.


***** These files with zero bytes are unrecoverable! *****

With regards,
Matthew Anstey