Related Resources • Vulnerable Security • Infected Attachments • Virus Encyclopedia • Glossary of terms

Affected Security Software
The worm searches for and deletes files related to antivirus and firewall software:

Program Files\Zone Labs
Program Files\AntiViral Toolkit Pro
Program Files\Command Software\F-PROT95
eSafe\Protect
PC-Cillin 95
PC-Cillin 97
Program Files\Quick Heal
Program Files\FWIN32
Program Files\FindVirus
Toolkit\FindVirus
f-macro
Program Files\McAfeeVirusScan95
Program Files\Norton AntiVirus
TBAVW95
VS95
rescue

ZoneAlarm firewall is not vulnerable to this method, as ZoneLabs implements additional protection to prevent their files from being deleted. The article, How Vulnerable Is Your Security? discusses other worms that also disable antivirus and security software. Affected users are urged to verify the integrity of their security software after removing the infection from their system. The EICAR test file can be used to determine whether antivirus software is functioning properly.