CERT^® Advisory CA-1999-06 ExploreZip Trojan Horse Program

A complete revision history is at the end of this file.

Systems Affected

• Machines running Windows 95, Windows 98, or Windows NT.
• Machines with filesystems and/or shares that are writable by a user of an infected system.
• Any mail handling system could experience performance problems or a denial of service as a result of the propagation of this Trojan horse program.

Overview

The CERT Coordination Center continues to receive reports and inquiries regarding various forms of malicious executable files that are propagated as file attachments in electronic mail.

During the second week of June 1999, the CERT/CC began receiving reports of sites affected by ExploreZip, a Trojan horse/worm program that affects Windows systems and has propagated in email attachments. The number and variety of reports we have received indicate that this has the potential to be a widespread attack affecting a variety of sites.

I. Description

Our original analysis indicated that the ExploreZip program is a Trojan horse, since it initially requires a victim to open or run an email attachment in order for the program to install a copy of itself and enable further propagation. Further analysis has shown that, once installed, the program may also behave as a worm, and it may be able to propagate itself, without any human interaction, to other networked machines that have certain writable shares.

The ExploreZip Trojan horse has been propagated between users in the form of email messages containing an attached file named zipped_files.exe. Some email programs may display this attachment with a "WinZip" icon. The body of the email message usually appears to come from a known email correspondent, and typically contains the following text:

I received your email and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs.

Opening the zipped_files.exe file causes the program to execute. It is possible under some mailer configurations that a user might automatically open a malicious file received in the form of an email attachment. When the program is run, an error message is displayed:

Cannot open file: it does not appear to be a valid archive. If this file is part of a ZIP format backup set, insert the last disk of the backup set and try again. Please press F1 for help.

Destruction of files

• The program searches local and networked drives (drive letters C through Z) for specific file types and attempts to erase the contents of the files, leaving a zero byte file. The targets may include Microsoft Office files, such as .doc, .xls, and .ppt, and various source code files, such as .c, .cpp, .h, and .asm.

• The program may also be able to delete files that are writable to it via SMB/CIFS file sharing. The program appears to look through the network neighborhood and delete any files that are shared and writable, even if those shares are not mapped to networked drives on the infected computer.

• The program appears to continually delete the contents of targeted files on any mapped networked drives.

  The program does not appear to delete files with the "hidden" or "system" attribute, regardless of their extension.

System modifications

• The zipped_files.exe program creates a copy of itself in a file called explore.exe in the following location(s):

  On Windows 98 - C:\WINDOWS\SYSTEM\Explore.exe
  On Windows NT - C:\WINNT\System32\Explore.exe

  This explore.exe file is an identical copy of the zipped_files.exe Trojan horse, and the file size is 210432 bytes.
  MD5 (Explore.exe) = 0e10993050e5ed199e90f7372259e44b

• On Windows 98 systems, the zipped_files.exe program creates an entry in the WIN.INI file:

  run=C:\WINDOWS\SYSTEM\Explore.exe

  On Windows NT systems, an entry is made in the system registry:

  [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  run = "C:\WINNT\System32\Explore.exe"

Propagation via file sharing

• Each time the program is executed, the program will search the network for all shares that contain a WIN.INI file with a valid "[windows]" section in the file.

• For each such share that it finds, the program will attempt to
  • copy itself to a file named _setup.exe on that share

  • modify the WIN.INI file on that share by adding the entry "run=_setup.exe"

  The account running the program on the original infected machine needs to have permission to write to the second victim's shared directory. (That is, no vulnerabilities are being exploited in order for the program to spread in this manner.)

  The _setup.exe file is identical to the zipped_files.exe and explore.exe files on the original infected machine.

• The original infected system will continue to scan shares that have been mapped to a local drive letter containing a valid WIN.INI file. For each such share that is found, the program will "re-infect" the victim system as described above.

When run as _setup.exe, the program will attempt to

• make another copy of itself in C:\WINDOWS\SYSTEM\Explore.exe

• modify the WIN.INI file again by replacing the "run=_setup.exe" entry with "run=C:\WINDOWS\SYSTEM\Explore.exe"

Note that when the program is run as _setup.exe, it configures the system to later run as explore.exe. But when run as explore.exe, it attempts to infect shares with valid WIN.INI files by configuring those files to run _setup.exe. Since this infection process includes local shares, affected systems may exhibit a "ping pong" behavior in which the infected host alternates between the two states.

Propagation via email

The program propagates by replying to any new email that is received by the infected computer. The reply messages are similar to the original email described above, each containing another copy of the zipped_files.exe attachment.

We will continue to update this advisory with more specific information as we are able to confirm details. Please check the CERT/CC web site for the current version containing a complete revision history.

II. Impact

• Users who execute the zipped_files.exe Trojan horse will infect the host system, potentially causing targeted files to be destroyed.

• Users who execute the Trojan horse may also infect other networked systems that have writable shares.

• Because of the large amount of network traffic generated by infected machines, network performance may suffer.

• Indirectly, this Trojan horse could cause a denial of service on mail servers. Several large sites have reported performance problems with their mail servers as a result of the propagation of this Trojan horse.

III. Solution

Use virus scanners

In order to detect and clean current viruses, you must keep your scanning tools up to date with the latest definition files. Please see the following anti-virus vendor resources for more information about the characteristics and removal techniques for the malicious file known as ExploreZip.

Aladdin Knowledge Systems, Inc.
http://www.esafe.com/vcenter/explore.html

Central Command
http://www.avp.com/zippedfiles/zippedfiles.html

Command Software Systems, Inc
http://www.commandcom.com/html/virus/explorezip.html

Computer Associates
http://www.cai.com/virusinfo/virusalert.htm

Data Fellows
http://www.datafellows.com/news/pr/eng/19990610.htm

McAfee, Inc. (a Network Associates company)
http://www.mcafee.com/viruses/explorezip/default.asp

Network Associates Incorporated
http://www.avertlabs.com/public/datafiles/valerts/vinfo/va10185.asp

Sophos, Incorporated
http://www.sophos.com/downloads/ide/index.html#explorez

Symantec
http://www.symantec.com/avcenter/venc/data/worm.explore.zip.html

Trend Micro Incorporated
http://www.antivirus.com/vinfo/alerts.htm

Additional sources of virus information are listed at

http://www.cert.org/other_sources/viruses.html

Additional suggestions

• Blocking Netbios traffic at your network border may help prevent propagation via shares from outside your network perimeter.

• Disable file serving on workstations. You will not be able to share your files with other computers, but you will be able to browse and get files from servers. This will prevent your workstation from being infected via file sharing propagation.

• Maintain a regular, off-line, backup cycle.

General protection from email Trojan horses and viruses

• False upgrade to Internet Explorer - discussed in CA-99-02
  http://www.cert.org/advisories/CA-99-02-Trojan-Horses.html

• Melissa macro virus - discussed in CA-99-04
  http://www.cert.org/advisories/CA-99-04-Melissa-Macro-Virus.html

• Happy99.exe Trojan Horse - discussed in IN-99-02
  http://www.cert.org/incident_notes/IN-99-02.html

• CIH/Chernobyl virus - discussed in IN-99-03
  http://www.cert.org/incident_notes/IN-99-03.html

• Making false claims that a file attachment contains a software patch or update

• Implying or using entertaining content to entice a user into executing a malicious file

• Using email delivery techniques which cause the message to appear to have come from a familiar or trusted source

• Packaging malicious files in deceptively familiar ways (e.g., use of familiar but deceptive program icons or file names)

http://www.cert.org/advisories/CA-99-02-Trojan-Horses.html

CERT/CC Contact Information

Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:

CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.

CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends.

Using encryption

We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from

http://www.cert.org/CERT_PGP.key

If you prefer to use DES, please call the CERT hotline for more information.

Getting security information

CERT publications and other security information are available from our web site

http://www.cert.org/

* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.

NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement.

Copyright 1999 Carnegie Mellon University.

June 10, 1999:  Initial release
June 11, 1999:  Added information about the appearance of the attached file
                Added information from Aladdin Knowledge Systems, Inc.
June 14, 1999:  Added information about the program's self-propagation via
                networked shares; also updated anti-virus vendor URLs