Destructive "Worm" Virus Spreads

If you thought Melissa was nasty, hang on to your hard drive because there's a bigger, badder virus in town.

Worm.ExploreZip, a Trojan horse virus discovered in Israel and reported to Symantec's AntiVirus Research Center on Sunday, dupes Microsoft Outlook and Exchange users by automatically answering incoming e-mail. It sends a response with your name and the same subject header.

Unlike Melissa, however, Worm.ExploreZip attaches destructive files.

"From the day Melissa hit, we've seen a tremendous up-tick in the virus-writing underground and hacker community of people trying to take the effectiveness of Melissa and attach a destructive payload to it. This virus appears to have succeeded," says Wes Wasson, director of product marketing for Network Associates. The company's McAfee division updated its detection software to recognize the virus earlier this week, but raised the risk-assessment profile to high this morning.

An e-mail message infected by Worm.ExploreZip contains an attachment called zipped_files.exe. The body of the message reads: "Hi [recipient's name]! I received your e-mail and I shall send you a reply ASAP. Till then, take a look at the attached zipped docs. Bye."

If the recipient opens the attached file, the virus replicates itself, takes control of the recipient's mail client, scans the address book to propagate itself, and responds to every e-mail message the PC receives.

Furthermore, the Worm.ExploreZip virus can destroy any file with a .h, .c, .cpp, .asm, .doc, .ppt, or .xls extension on your hard drive or mapped drives, according to a virus alert posted on Symantec's Web site. It destroys files on the C through Z drives by truncating them to 0 bytes.

Several major U.S. businesses temporarily shut down their e-mail systems on Thursday as a direct result of the Worm.ExploreZip virus, also known as the W32.ExploreZip Worm. Affected companies include Microsoft, NBC, and General Electric, according to the antivirus companies whose software the victims license.