🚀 go-pugleaf

Hatto von Hatzfeld <hatzfeld@tronet.de> wrote:
> Wenn man die Datei zipped_files.exe dummerweise �ffnet, l�scht das
> Programm *.doc-Dateien auf dem Rechner und verschickt sich als Mail an
> auf dem Rechner zu findenden E-Mail-Adressen.

Nicht nur. Das Cert-Advisory ist da eindeutig genauer: 

- - - - - - - - Snip here to damage your screeen - - - - - - - - 
   Opening the zipped_files.exe file causes the program to execute. At
   this time, there is conflicting information about the exact actions
   taken by zipped_files.exe when executed. One possible reason for
   conflicting information may be that there are multiple variations of
   the program being propagated, although we have not confirmed this one
   way or the other. Currently, we have the following general information
   on actions taken by the program.

     * The program searches local and networked drives (drive letters C
       through Z) for specific file types and attempts to erase the
       contents of the files, leaving a zero byte file. The targets may
       include Microsoft Office files, such as .doc, .xls, and .ppt, and
       various source code files, such as .c, .cpp, .h, and .asm.
     * The program propagates by replying to any new email that is
       received by an infected computer. A copy of zipped_files.exe is
       attached to the reply message.
     * The program creates an entry in the Windows 95/98 WIN.INI file:
       run=C:\WINDOWS\SYSTEM\Explore.exe
       On Windows NT systems, an entry is made in the system registry:
       [HKEY_CURRENT_USER\Software\Microsoft\Windows
       NT\CurrentVersion\Windows]
       run = "c:\winnt\system32\explore.exe"
     * The program creates a file called explore.exe in the following
       locations:
       Windows 95/98 - c:\windows\system\explore.exe
       Windows NT - c:\winnt\system32\explore.exe
       This file is a copy of the zipped_files.exe Trojan horse, and the
       file size is 210432 bytes.
       MD5 (Explore.exe) = 0e10993050e5ed199e90f7372259e44b

   We will update this advisory with more specific information as we are
   able to confirm details. Please check the CERT/CC web site for the
   current version containing a complete revision history.
- - - - - - - - Snip here to damage your screeen - - - - - - - - 

Cheers
       Christian
-- 
The inherent vice of capitalism is the unequal sharing of blessings;
the inherent virtue of socialism is the equal sharing of misery.
		-- Churchill
/* http://www.rhein-neckar.de/~jupiter/                       Christian Kurz  */