ITinfo: ExploreZip Jr. Foils Anti-Virus Software

Site Directory
Membership
Train-the-Trainer
Trainer Certification
Certified Training Materials
ITinfo E-zine
Responsible Training
White Papers
Trainer Resources
What's New
Speaking Engagements
Onsite Training
ITrain Gear

ExploreZip Worm Returns

MiniZip compressed version sneaks past anti-virus apps

ITinfo Sponsor

ERROR: Random File Unopenable

The random file, as specified in the $random_file perl variable was unopenable.

The file was not found on your file system. This means that it has either not been created or the path you have specified in $trrandom_file is incorrect.

ExploreZip Jr. Foils Anti-Virus Software

by Dave Murphy
ISSN 1535-3613

First reported by ITinfo in June (see related article below), the ExploreZip worm has returned and it's back with a vengeance.

A new compressed version has attacked several major companies. According to Dan Schrader, Trend Micro's Vice President of New Technology, "ExploreZip hasn't been altered at all: all someone did was store it in a very unusual compression format, called Neolite. We already scan for compressed files, but they chose one that we don't [detect] so far."

It's being dubbed MiniZip by some security vendors. It's the same technology as the worm's first iteration, but because it's signature is altered by the Neolite compression, anti-virus programs can't yet detect it.

All three leading anti-virus security firms, Network Associates, Symantec, and Trend Micro have received copies of the virus from infected customers.

If the worm's infection follows the same pattern as the original ExploreZip, Asia will see a marked increase in rates of infection overnight Tuesday evening, and the U.S. and Europe will follow with infections on Wednesday.

The worm's payload is the same as before: deleting files, and automatically sending infected email messages to address book lists. It affects systems running Microsoft Outlook, Outlook Express, and Exchange.

Call for Comments

What do you think? Have you run across the ExploreZip virus? Leave your comments on the message center: http://itrain.org/msg/

Worm.ExploreZip Does More Damage

References

Trend Micro
Network Associates
Symantec AntiVirus Research Center

Previous issues are on our website at http://itrain.org/itinfo/.

International Association of Information Technology Trainers
PMB 616
6030-M Marshalee Dr
Elkridge, MD 21075-5987

410.567.5366
1.888.290.6200
fax: 801.650.0423
Membership Director: member@itrain.org

Return to ITrain Homepage

http://itrain.org/itinfo/1999/it991130a.html
updated November 30, 1999