The virus will search out and set to zero bytes Excel and Word files and
several other types of files. We have even found files on the network drives
that have been zeroed. This destruction will occur every half hour until
each occurrence of the virus is eliminated. It appears that the program
explore.exe is a TSR. You must first stop the task before you can delete it.
Also check your WIN.ini file for corruption. You can do a search for files
that have been modified today and are less than 1 KB in size. If you have
backups of those files, they can be recovered.
Richard Woods
----------
From: Knighten, Jim L [SMTP:[email protected]]
Sent: Wednesday, December 01, 1999 12:27 PM
To: [email protected]
Subject: RE: Virus alert, do not open the message from Jeffrey
Collins
Yes,
This is a virus message and I was attacked when I opened
its.
Below is what Symantec says about it.
>WARNING! New virus surfaces on the Internet!
>
>Worm.ExploreZip(pack) is a new version of Worm.ExploreZip.
>
>** This virus SHOULD BE CONSIDERED DANGEROUS! **
>Once the attachment is opened/executed, it will unpacked
itself and
>execute the original Worm.ExploreZip routine. It might
display an
>error message informing the user that the file is not a
valid
>archive.
>
>The worm proceeds to copy itself to the c:\windows\system
directory
>with the filename "Explore.exe" and then modifies the
WIN.INI file
so
>that the program is executed each time Windows is started.
The worm
>then utilizes your e-mail client to harvest e-mail
addresses in
order
>to propagate itself. Users may notice that their e-mail
client
>launches when this occurs.
________________________________________________________
Dr. Jim Knighten e-mail:
[email protected]
<mailto:[email protected]>
Senior Consulting Engineer
NCR
17095 Via del Campo
San Diego, CA 92127 http://www.ncr.com
<http://www.ncr.com>
Tel: 858-485-2537
Fax: 858-485-3788
***** Notice the Area Code change from 619 *****
-----Original Message-----
From: [email protected] [mailto:[email protected]]
Sent: Wednesday, December 01, 1999 6:14 AM
To: [email protected]
Subject: Virus alert, do not open the message
from
Jeffrey Collins
According to the news this morning the new virus
scheduled
to activate today
is identical to this message which we all received
from
Jeffrey Collins. I
would advise you to delete without opening.
Rick
-----Original Message-----
From: Collins, Jeffrey [mailto:[email protected]]
<mailto:[mailto:[email protected]]>
Sent: Tuesday, November 30, 1999 5:38 PM
To: '[email protected]'
Subject: RE: Laser Standards
Hi !
I received your email and I shall send you a reply
ASAP.
Till then, take a
look at the attached zipped docs. bye.
<<zipped_files.exe>>
---------
This message is coming from the emc-pstc discussion
list.
To cancel your subscription, send mail to
[email protected]
with the single line: "unsubscribe emc-pstc"
(without the
quotes). For help, send mail to [email protected],
[email protected], [email protected], or
[email protected] (the list
administrators).
---------
This message is coming from the emc-pstc discussion list.
To cancel your subscription, send mail to [email protected]
with the single line: "unsubscribe emc-pstc" (without the
quotes). For help, send mail to [email protected],
[email protected], [email protected], or
[email protected] (the list administrators).
---------
This message is coming from the emc-pstc discussion list.
To cancel your subscription, send mail to [email protected]
with the single line: "unsubscribe emc-pstc" (without the
quotes). For help, send mail to [email protected],
[email protected], [email protected], or
[email protected] (the list administrators).
