TROJ EXPLOREZIP Is Back with a Twist.

CUPERTINO, Calif.--(BUSINESS WIRE)--Nov. 30, 1999--

A Variant of the Autospam TROJ_EXPLOREZIP Worm,

TROJ_EXPZIPWMPAK, is Spreading Quickly and Damaging Files

Trend Micro Inc., (Nasdaq:TMIC) the leader in centrally managed virus protection and content filtering products and services, has developed a solution to a newly discovered variant of the Trojan ExploreZip worm originally discovered in June, 1999.

This variant, TROJ_EXPZIPWMPAK, is identical to the original ExploreZip worm in that it is auto-spamming malicious code that destroys data on the infected system. The only significant difference between this variant of the worm and the original is that TROJ_EXPZIPWMPAK is compressed with a different type of compression format, thereby evading protection for the previous worm. TROJ_EXPZIPWMPAK attacks Windows 95, 98, and NT systems and has been detected at several Fortune 500 customer sites in the United States.

How It Works

TROJ_EXPZIPWMPAK emails itself out as an attachment under the filename "zipped_files.exe". The subject line of the email varies. The body of the email message may also contain the following text: -0-

     Hi (Recipient Name)!

     I received your email and I shall send you a reply ASAP. Till
     then, take a look at the attached zipped docs. Bye (This
     salutation messages changes and may be "Bye", Sincerely" and
     "All")

-0-

After a user clicks on the attachment, this destructive trojan searches hard drives C: through Z:, selecting the Microsoft Word, Excel and PowerPoint files as well as source code files used by programmers including C++, C, and Assembler source files and reduces their file size to zero, making the data unrecoverable. When executed, TROJ_EXPZIPWMPAK utilizes MAPI enabled email systems, to automatically reply to any subsequently received email messages. The email reply will include the infected attachment with the message shown above. It will use the subject line of the received email when it replies.

"TROJ_EXPLOREZIP caused millions of dollars of damage worldwide the first time around, so we're not taking its second coming lightly," says David Perry, public education director for Trend Micro. "Since it overwrites files, instead of just deleting them, it's particularly damaging and because of its insidious social engineering, TROJ_EXPZIPWMPAK has the ability to fool a lot of people into innocently opening and triggering it."

Solutions Available from Trend Micro

To protect against this dangerous worm, computer users will need to have an antivirus solution that has been updated to protect against TROJ_EXPZIPWMPAK. Trend Micro customers can download an updated pattern file (No. 615) from Trend Micro's Web site to ensure they are protected. Concerned computer users can also surf to www.antivirus.com and use HouseCall(TM), Trend Micro's free Internet virus scanning service to detect and remove the malicious trojan from their system.

More information about "TROJ_EXPZIPWMPAK" can be obtained from Trend's Website at http://www.antivirus.com.

About Trend Micro

Trend Micro provides centrally controlled server-based virus protection and content-filtering products and services. By protecting information that flows through Internet gateways, email servers, and file servers, Trend Micro allows companies worldwide to stop viruses and other malicious code from a central point before they ever reach the desktop.

Trend Micro's award-winning products have been chosen by Check Point Software Technologies, Cisco Systems, Compaq, Hewlett-Packard, IBM, ISS, Lotus, Lucent Technologies, Microsoft, Oracle, Sprint, Sun Microsystems and U S WEST as part of their server security solutions.

Trend Micro's corporate headquarters is located in Tokyo, Japan, with business units in North and South America, Europe, Asia, and Australia. The North American head office is located in Cupertino, CA. Trend Micro's products are sold directly and through a network of corporate and value-added resellers.

Evaluation copies of all of Trend Micro's products may be downloaded from its award-winning site, http://www.antivirus.com. Web site visitors may also test-drive products online through Trend Micro's Virtual Lab.

HouseCall is a trademark of Trend Micro Incorporated. Other product and company names may be trademarks of their respective owners.

Note to Editors: In the virus names throughout this press release, an underscore symbol should appear after the letters TROJ. This symbol may not appear properly in some systems.