I am sure you've heard this on the news... Here's the lowdown. HTH -jeane ---------- Forwarded message ---------- Date: Thu, 10 Jun 1999 17:21:55 GMT From: "Mikko H. Hypponen" <[email protected]> Newsgroups: alt.comp.virus Subject: Re: Any news of "zipped_files.exe" virus? In article <[email protected]>, "Eric Ray" <[email protected]> wrote: > I looked on McAfee's and Datafellows web sites and couldn't find anything in > the virus section or the hoax section. Please see more information here: http://www.Europe.DataFellows.com/v-descs/zipped.htm And download a F-Secure Anti-Virus update that will detect and disinfect it from here: ftp://ftp.europe.datafellows.com/anti-virus/updates/fsupdate.exe Here's what we know now: ---- A new e-mail worm spreading globally 'ZippedFiles' or 'ExploreZip' spreads like Melissa A new e-mail worm has been detected spreading in the internet. This virus works like a chain letter and carries a destructive payload. So far it has been reported from a dozen countries, including USA, Germany, Norway, Israel and Czech Republic. The virus is expected to spread globally within hours. This virus is known as either 'ZippedFiles' or 'ExploreZip'. It arrives to a user via an e-mail attachment. When the attachment is opened, the virus will browse through the inbox of the Microsoft Outlook e-mail program and will send a reply to every message. As a result, if a user called John Doe has recently received an e-mail from Jane Smith with the subject 'Please check these numbers', John's machine will automatically send a message which will look like this: From: John Doe To: Jane Smith Subject: RE: Please check these numbers Hi Jane I have received your email and I shall send you a reply ASAP. Till then take a look at the attached zipped docs. Sincerely John. Attachment: zipped_files.exe The attachment looks like a WinZip archive file. When the received tries to unpack it by double-clicking it, he will get a WinZip error message complaining about a broken archive: Cannot open file: it does not appear to be a valid archive. If this file is part of a ZIP format backup set, insert the last disk of the backup set and try again. Please press F1 for help. In addition to spreading like a chain letter, the virus will try to overwrite users files on any accessible drives, including all network drives. The files that get overwritten must have one of these extensions: DOC - Microsoft Word documents XLS - Microsoft Excel spreadsheets PPT - Microsoft PowerPoint presentations ASM - Assembler source files CPP - C++ source files -- Mikko Hermanni Hypp�nen, [email protected] Manager, Anti-Virus Research, Data Fellows Corp. Integrated Solutions for Enterprise Security Tel +358 9 8599 0513 - fax +358 9 8599 0713 http://www.DataFellows.com/staff/hermanni/