Worm.ExploreZip
What is Worm.ExploreZip?
Worm.ExploreZip affects 32-bit Windows operating systems, such as Win95, Win98, and Windows NT. It was first reported on June 9, 1999.
It appears that not everyone can spread Worm.ExploreZip, which is transmitted by an attachment in an e-mail reply from MAPI-aware mail programs such as MS Outlook, Outlook Express, Exchange, and Netscape Communicator on infected desktops. However, it does appear that anyone who receives and executes the attached file can be infected and suffer data loss.
A worm is contained in an attached document disguised and labelled as a zip file. The virus has been constructed to search out and delete the contents of files with the following extensions: .h, .c, .cpp, .asm, .doc, .xls., .ppt.
How do I know if I my system is infected with Worm.ExploreZip?
If you are affiliated with Boston University, you can download and install the latest version of Network Associates' McAfee VirusScan for free, as Boston University has a site license for this product. Please visit BU's anti-virus software Web site for more information. This site will prompt you for your BU login name and password before allowing access. Note that this program checks for, but does not remove, Worm.ExploreZip.
How can I remove Worm.ExploreZip?
The following information is taken from Network Associates Virus Alert page at http://vil.nai.com/vil/content/v_10450.htm#RemovalInstructions.
Win9x-
Restart to MS-DOS mode, edit the WIN.INI and remove the listing
run=c:\windows\system\explore.exe
Then delete the file "c:\windows\system\explore.exe" and restart Windows.
WinNT-
This worm runs as a process in WinNT Task Manager as "explore". You may experience high CPU utilization prior to ending this process. Run REGEDIT (not REGEDT32) and locate the hive
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
and remove the following key
"run"="C:\\WINNT\\System32\\Explore.exe"
Restart Windows NT, then remove the file "c:\winnt\system32\Explore.exe"Where can I find more information on Worm.ExploreZip?
See the following Web pages:
22 February 2000
Office of Information Technology
Boston University
Questions