Widespread Virus Outbreak: "ZippedFiles" Worm Infects Multiple Companies and Emails

Strategic Insights -

A highly infectious virus, known as "ZippedFiles" or "Worm.ExploreZip," has been wreaking havoc on computer systems and email servers at several prominent companies, including Microsoft, Intel, and NBC. This virus, which arrives as an email with a seemingly innocuous message, has been spreading rapidly, destroying files and shutting down mail servers in at least a dozen countries.

Key Takeaways:

  • The virus arrives as an email with an attached file called zipped_files.exe, which copies itself to the Windows System directory and modifies the WIN.INI registry to execute every time the user starts Windows.
  • The worm destroys files with the extensions .h, .c, .cpp, .asm, .doc, .ppt, or .xls on the system hard drive or any mapped drives.
  • The virus also searches through the C through Z drives of a computer system and selects a series of files of any extension to make 0 bytes long, effectively destroying them as well.
  • ZippedFiles can infect systems without email clients, but it won't spread any further if a copy of Microsoft Outlook is not available.
  • The virus can propagate itself by sending copies of the original email to the addresses in a Microsoft Outlook address book.
  • Data Fellows Corp, a San Jose-based company, has reported the virus from a dozen countries, including Germany, Norway, Israel, and the Czech Republic.
  • The key issue with this virus is that the messages sent by ZippedFiles are very credible and normal-looking, making it likely for users to trust and open the attachment.
  • Data Fellows has prepared an update to detect and disinfect the virus, while Network Associates Inc suggests restarting an infected computer in MS-DOS mode to remove the malicious file.

Statistics:

  • At least half a dozen companies have been reported to be infected, including Microsoft, Intel, NBC, GE, Lucent, and EMC.
  • The virus has been reported from a dozen countries, including Germany, Norway, Israel, and the Czech Republic.
  • The virus destroys files with the extensions .h, .c, .cpp, .asm, .doc, .ppt, or .xls, which indicate C++ and assembler source files, Word documents, PowerPoint presentations, and Excel spreadsheets.
  • ZippedFiles can propagate itself by sending copies of the original email to the addresses in a Microsoft Outlook address book.

Sources:

  • Rachel Chalmers, unnamed article (date not specified)
  • Data Fellows Corp, unnamed press release (date not specified)
  • Mikko Hypponen, manager of anti-virus research at Data Fellows (quoted in the article)