Print

Print


Messages like this are often hoaxes.  Are you sure some spammer didn't
take a real McAfee advertising letter, doctor it up, tack on a new subject
line and forge the return address?

It's hard to believe Network Associates would misspell "virus" in the
subject line of a letter to thousands of customers.  Or end the message
with a reference to a "marketing policy" that they haven't followed.
Still, just in case, I'm sending a copy to my company's IT department.
:-)

And it's ALWAYS good advice to avoid executing programs attached to e-mails.

----- Begin Included Message -----

From [log in to unmask]  Fri Dec 10 00:36:05 1999
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Message-ID:  <[log in to unmask]>
Date:         Fri, 10 Dec 1999 13:24:46 +0800
Reply-To: "[log in to unmask]" <[log in to unmask]>
Comments:     RFC822 error: <W> TO field duplicated. Last occurrence was
              retained.
Comments:     RFC822 error: <W> TO field duplicated. Last occurrence was
              retained.
Comments:     RFC822 error: <W> TO field duplicated. Last occurrence was
              retained.
Organization: Edith Cowan University
Subject:      FW: Virius Alert - W32/ExploreZip.worm.pak
X-To:         "Wojciech Kuczborski (E-mail)" <[log in to unmask]>,
              "[log in to unmask]" <[log in to unmask]>
To: [log in to unmask]
From:  "[log in to unmask]" <[log in to unmask]>
X-Topic: Ada
X-Match:  "[log in to unmask]" <[log in to unmask]>
X-Lines: 103
Status: RO

-----Original Message-----
From:   McAfee.com Dispatch [SMTP:[log in to unmask]]
Sent:   Wednesday, December 01, 1999 2:43 PM
To:     [log in to unmask]
Subject:        Virius Alert - W32/ExploreZip.worm.pak

(((((((((((  McAfee.com Dispatch  ------  VIRUS ALERT )))))))))))))


[This message is brought to you as a subscriber to the
McAfee.com Dispatch. To unsubscribe, please follow the
instructions at the bottom of the page.]


************    W32/ExploreZip.worm.pak   ****************


Dear McAfee.com Dispatch Subscriber:


W32/ExploreZip.worm.pak is a new, compressed variant of the
original W32/ExploreZip.worm. AVERT has assessed it as a
high-risk threat, approaching outbreak levels! It reproduces
itself by sending replies to incoming email messages, with
itself as an attachment called "zipped_files.exe".

It includes a payload: it will search the user's mapped
drives and overwrite all files of types .c, .cpp, .asm,
.doc, .xls, .ppt. to zero Kb.

IMPORTANT - If you receive an email with the message
"I received your email and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs.",
DELETE IT IMMEDIATELY! It will have an attachment called
"zipped_files.exe"; DO NOT DOUBLE-CLICK OR RUN THIS
ATTACHMENT! If you do, it will infect your system!


VirusScan 4.0.25 and above requires the EXTRA.DAT
(W32exp-4.zip) to detect and remove W32/ExploreZip.worm.pak.

VirusScan 3.x cannot detect W32/ExploreZip.worm.pak because
it arrives in a compressed form. Users of VirusScan 3.x
should upgrade to the latest version.

Note: If you are using McAfee Clinic [Active Shield (TM)],
please click here to get the update.
-> http://clinic.mcafee.com/clinic/virusscan/activeshield

-- McAfee.com


_______________________  Virus Fixes ______________________________


Find out more about this virus. Click here to go to the
W32/ExploreZip.worm.pak Help Center.
-> http://www.mcafee.com/viruses/explorezip.pak/

Check if your system is infected, click here to use
VirusScan Online.
-> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=1105

Purchase the latest copy of VirusScan, please click here.
-> http://store.mcafee.com/category.asp?CatID=3&CategoryLevel=1&rfr=VSCALRT

Upgrade to the latest VirusScan. Purchase the VirusScan
Maintenance Plan which entitles you to 12 months of
upgrades, click here.
-> http://store.mcafee.com/category.asp?CatID=18&CategoryLevel=1&rfr=VRSPLN

Download the latest DAT files, click here.
-> http://download.mcafee.com/updates/updates.asp


_____________________  New Clinic Applications  ______________________


Try out the two latest applications on McAfee Clinic:
Application Remover -
-> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=1103
Application Restorer -
-> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=1104

______________________________________________________________________


Unsubscribe: If you do not want receive the McAfee.com
Dispatch in the future, click here.
-> http://www.mcafee.com/unsubscribe

This Virus Alert has been issued by the Network Associates
Anti-Virus Emergency Response Team (AVERT). McAfee.com is a
wholly owned subsidiary of Network Associates.

Copyright 1999 McAfee.com / All Rights Reserved.


______________________________________________________________________
This message was sent by McAfee.com using Responsys Interact.

To view our permission marketing policy:
    http://www.rsvp0.net


----- End Included Message -----