Printable View
There is a small p2p network that is having an issue that MS Word docs sparatically keep dissappearing. This has been happening for 5 months and today they finally deside to call me. Here are my deductions on this problem before I actually go over there:
1. User error.
2. Virus.
Does anybody else have any possible cause that is not listed?
3. file not saved where they think....
Yeah... that is why I listed user error (or misunderstanding) on the top. Ughhh users...:flame:Quote:
Originally posted by NooNoo
3. file not saved where they think....
VIRUS!!!
Name: Worm/ExplorerZip.E
Alias: W32/ExploreZi-N
Type: Internet Worm (UPX packed)
Discovered: January 8, 2003
Size: 91.048KB
Platforms: Windows
Description:
Worm/ExplorerZip.E is a mass mailing Internet worm that spreads through the use of stored e-mail addresses.
The worm arrives through e-mail in the following format:
Subject: RE: <random text>
Body:
Hi <email name> !
I received your email and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs.
bye.
Attachment: zipped_files.exe
If executed, the worm copies itself in the \windows\%system% directory under the filenames "_setup.exe", "<random filename>,exe" and "Explorer.exe".
Additionally, the "Win.ini" file in C:\Windows will also get modified:
- C:\Windows\Win.ini
run=
run=C:\Windows\system\_setup.exe or
run=C:\Windows\system\explore.exe
So that it gets run each time a user restart their computer the following registry key gets added:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
"run"="C:\\WINNT\\System32\\Explore.exe"
** Registry key created only with Microsoft Windows NT/2000/XP
Worm/ExplorerZip.E will then zero out the lengths of files with the following extensions:
- *.asm,
- *.c
- *.cpp
- *.doc
- *.h
- *.ppt
- *.xls
That one is gonna keep us very very busy....