Worm.ExploreZip virus

A devastating worm unleashed in the summer of 1999 that works with MAPI-based e-mail servers such as Microsoft Exchange. It automatically sends a stock reply to the sender of each incoming message that says "Hi <name of person>! I received your email and I will send you a reply ASAP. Till then, take a look at the attached zipped DOCs. Bye."

When the attached "ZIPPED_FILES.EXE" file is double clicked, it decompresses and places EXPLORE.EXE in your \WINDOWS\SYSTEM directory. It then proceeds to delete the data in Microsoft Word, Excel and PowerPoint files as well as assembly, C and C++ source files. You wind up with file names with 0 bytes. It also spreads to all the machines attached to the network.

Actual Damage

This is a small part of the damage done to one machine from the Worm.ExploreZip virus. Note that only the Microsoft files (Word, Excel and PowerPoint) were destroyed. This is one of those unfortunate times when you understand what offline backup really means.