Name:
ExploreZip wormAlso known as:
Worm.ExploreZip, W32.ExploreZip.Worm, ExploreZip.packed, W32/ExploreZipType:
Network and email wormDiscovered:
June 1999Description:
The ExploreZip email is sent as a reply to a normal email, thus the subject line will be that of the orginal and valid email. ExploreZip seaches all local drives for .c, .cpp, .h, .asm, .doc, .xls, and .ppt file types, which are overwritten continuously in 30 minute increments. The worm also infects both mapped and non-mapped network drives viewable from within Network Neighborhood.Message Displayed by Worm:
Cannot open file: it does not appear to be a valid archive. If this file is part of a ZIP format backup set, insert the last disk of the backup set and try again. Please press F1 for help.System Impact:
Copies itself to the Windows system directory as Explore.exe or _setup.exe. The default system directory on Windows XP is C:\Windows\System32. The worm modifies the Registry run key or the Win.ini file, depending on the operating system, in order to load when Windows is started.
