Subject: Worm.ExploreZip(pack) Virus Alert

From: Chip Sharp <[email-masked]>
Date: Wed, 1 Dec 1999 08:17:46 -0500

Looks like there is another round of the Worm.explorer virus going around.
I've gotten several automated replies to posts on the megaco list
containing the virus.

Remember not to open any attachments without scanning for viruses even if
it looks like a valid reply to any email.

Chip

The following is a sample bogus email:

From:
To: "[email-masked]'" <[email-masked]>
Subject: RE: Q.BICC
Date: Tue, 30 Nov 1999 17:34:57 -0800
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2448.0)
Content-Type: multipart/mixed;
        boundary="----_=_NextPart_000_01BF3B9C.47ED4813"
X-SMTP-HELO: baucis.sc.intel.com
X-SMTP-MAIL-FROM:
X-SMAP-Received-From: outside
X-SMTP-PEER-INFO: baucis.sc.intel.com [143.183.152.22]
X-UIDL: c0915ee5a4bdbea8a151f22310783320

Hi Chip !
I received your email and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs.
bye.
  <<zipped_files.exe>>
Content-Type: application/octet-stream;
        name="zipped_files.exe"
Content-Disposition: attachment;
        filename="zipped_files.exe"
Content-Transfer-Encoding: base64

TVpQAAIAAAAEAA8A//8AALgAAAAAAAAAQAAaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

WARNING: The remainder of this message has not been transferred.
The estimated size of this message is 167225 bytes.
Click on the server retrieve icon above and check mail again to get the
whole thing.  If the server retrieve icon is not showing, then this message
is no longer on the server.
Support NetAid!  http://www.netaid.org
--------------------------------------------------
Chip Sharp                 Consulting Engineering
Cisco Systems              Telco Bio-region
Reality - Love it or Leave it.
--------------------------------------------------

---

From: Matt Holdrege <[email-masked]>
Date: Wed, 1 Dec 1999 15:50:29 -0800

Yep, I also received one addressed from someone at intel.com.
But I never open executable files from people I don't know. :)