From britdisc-owner@csv.warwick.ac.uk Fri Jun 11 12:09:37 1999 Received: by pansy.csv.warwick.ac.uk (8.9.3/8.9.3) id MAA15838 for britdisc-outgoing; Fri, 11 Jun 1999 12:08:22 +0100 (BST) Received: from daffodil.csv.warwick.ac.uk (daffodil [137.205.192.30]) by pansy.csv.warwick.ac.uk (8.9.3/8.9.3) with ESMTP id MAA15832 for <britdisc@csv.warwick.ac.uk>; Fri, 11 Jun 1999 12:08:20 +0100 (BST) Received: from finch-post-11.mail.demon.net (finch-post-11.mail.demon.net [194.217.242.39]) by daffodil.csv.warwick.ac.uk (8.9.3/8.9.3) with ESMTP id MAA00395 for <britdisc@csv.warwick.ac.uk>; Fri, 11 Jun 1999 12:08:19 +0100 (BST) Received: from postcard.kscl.com ([194.159.98.2]) by finch-post-11.mail.demon.net with esmtp (Exim 2.12 #1) id 10sPAI-0002Fp-0B for britdisc@csv.warwick.ac.uk; Fri, 11 Jun 1999 11:08:02 +0000 Received: by POSTCARD.kscl.com with Internet Mail Service (5.5.2232.9) id <LYSH789T>; Fri, 11 Jun 1999 12:07:01 +0100 Message-ID: <B1CB12627F4DD2119A6F0001FA7E1EB4E9DD9B@POSTCARD.kscl.com> From: Fraser Macrae <fraser.macrae@kscl.com> To: "'BritDisc'" <britdisc@csv.warwick.ac.uk> Subject: FW: MEDIA RELEASE: 'ZippedFiles' or 'ExploreZip' spreads like Mel issa Date: Fri, 11 Jun 1999 12:06:52 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2232.9) Content-Type: text/plain; charset="iso-8859-1" Sender: owner-britdisc@warwick.ac.uk Precedence: bulk definitely not a hoax. It took out 80% of scottish office yesterday, attacked SKy and loads of other companies around. we've had calls from all local papers here in Edinburgh. And all our suppliers. check local and national press today and tomorrow for more info. Fraser Sneeekys > ---------- > From: Marita Nasman-Repo[SMTP:Marita.Nasman-Repo@DataFellows.com] > Sent: Thursday, June 10, 1999 8:14 PM > To: press-english-technical@lists.datafellows.com; > press-english-interest@lists.datafellows.com; > press-pr@lists.datafellows.com; > press-english-virus-announcement@lists.datafellows.com > Subject: MEDIA RELEASE: 'ZippedFiles' or 'ExploreZip' spreads like > Melissa > > > This press release comes from Data Fellows. For more information on > Data Fellows' mailing list policy, see end of message. > > Press release > > For immediate release > > A new e-mail worm spreading globally > > 'ZippedFiles' or 'ExploreZip' spreads like Melissa > > Espoo, Finland, June 10, 1999 - A new e-mail worm has been found and is > spreading rapidly through the Internet. This virus works like a chain > letter > and carries a destructive payload. So far, it has been reported from a > dozen > countries, including USA, Germany, Norway, Israel and the Czech Republic. > The > virus is expected to spread globally within hours. > > This virus is known as either 'ZippedFiles' or 'ExploreZip'. It arrives to > a > user via an e-mail attachment. When the attachment is opened, the virus > will > browse through the inbox of the Microsoft Outlook e-mail program and will > send > a reply to every message. > > As a result, if a user called John Doe has recently received an e-mail > from > Jane Smith with the subject 'Please check these numbers', John's machine > will > automatically send a message which will look like this: > > From: John Doe > To: Jane Smith > Subject: RE: Please check these numbers > > Hi Jane > > I have received your email and I shall send you a reply ASAP. > Till then take a look at the attached zipped docs. > Sincerely > John. > > Attachment: zipped_files.exe > > The attachment looks like a WinZip archive file. When the received tries > to > unpack it by double-clicking it, he will get a WinZip error message > complaining > about a broken archive: > > Cannot open file: it does not appear to be a valid archive. > If this file is part of a ZIP format backup set, insert the last disk of > the > backup set and try again. > Please press F1 for help. > > In addition to spreading like a chain letter, the virus will try to > overwrite > the user's files on any accessible drives, including all network drives. > The > files that are overwritten must have one of these extensions: > > DOC - Microsoft Word documents > XLS - Microsoft Excel spreadsheets > PPT - Microsoft PowerPoint presentations > ASM - Assembler source files > CPP - C++ source files > > If the recipient is using an e-mail system other than Microsoft Outlook, > ZippedFiles will not spread further. However, it will damage the > recipient's > files. ZippedFiles operates under the Windows 95, 98 and NT operating > systems. > > "This seems to be spreading fast," Mikko Hypponen, Manager of Anti-Virus > Research at Data Fellows Corporation, comments, "but not as fast Melissa. > The > key issue here is that messages sent by ZippedFiles are very credible - > they > are normal-looking replies to messages you have sent earlier. You're quite > likely to trust these messages and open the attachment." > > Data Fellows has analysed ZippedFiles and has provided an update to detect > and > disinfect it. More technical information on the virus and the update are > both > available from http://www.DataFellows.com or > http://www.europe.datafellows.com/v-descs/zipped.htm > > About Data Fellows > > Data Fellows is one of the world's leading developers of data security > products. The Company offers integrated solutions for enterprise security > by > developing, marketing and supporting anti-virus, data security and > cryptography > software products for corporate computer networks. The Company has > customers in > more than 100 countries, including many of the world's largest industrial > corporations and best-known telecommunications companies, major > international > airlines, European governments, post offices and defence forces, and > several of > the world's largest banks. > > The Company has received numerous awards and citations each year from > leading > software magazines and publications around the world. They include being > selected one of the Top 100 Technology companies in the world by Red > Herring > magazine in its September 1998 issue and being named Editor's Choice by PC > Magazine. > > For more information, contact > > Data Fellows Corporation > 675 N. First Street, 8th Floor > San Jose, CA 95112 > tel (408) 938-6700; fax (408) 938-6701 > > or > > Data Fellows Corporation > Mikko Hyppönen, Manager, Anti-Virus Research. > PL 24 > FIN-02231 ESPOO > tel s +358 9 8599 0513 > fax +358 9 8599 0599 > e-mail: Mikko.Hypponen@DataFellows.com > > http://www.DataFellows.com/ > > Mailing list policy > > You have previously expressed interest in our products, or have asked > to be included on one of our press release lists by personally giving us > your e-mail address for this purpose. Our mailing list are for the > exclusive use and the expressed purpose of Data Fellows and are not > sold or or given to third parties. > > If you no longer wish to receive our press releases, or your email address > > has been added to our lists without your consent, you may remove yourself > > from our mailing lists by replying to this message with the words "remove > <your_address@your_domain.com>" in the Subject line. > > If you only wish to receive our press releases concerning viruses, please > > reply to this message with the text "remove > <your_address@your_domain.com>" > in the subject line, and send a second reply with the text "add virus info > <your_address@your_domain.com>" in the subject line. > ------------------------- > Marita Näsman-Repo tel: +358 9 8599 0613 > Communicator, Media relations fax: +358 9 8599 0813 > mobile: +358 40 517 4613 > Data Fellows Corporation http://www.DataFellows.com > > F-Secure products: Integrated Solutions for Enterprise Security > > -------------------------------------------------------------------------- > --- >