Worm.ExploreZip - Removal

Symantec Security Response has provided a small utility named FixExzip.exe to remove the virus from memory and undo the changes made by the worm. Please click here to obtain this tool. This is the recommended method for removing this worm.

If you want to remove this worm manually, follow these steps:

• If you are running Windows 95/98:
  1. Open the Win.ini file in a text editor such as the System Configuration Editor (Sysedit.exe).
  2. Remove the command C:\Windows\System\Explore.exe or C:\Windows\System\_Setup.exe from the run= line.
  3. Restart the computer.
  4. Delete Explore.exe from the C:\Windows\System folder.
     
• If you are running Windows NT:
  1. Start the Registry Editor (Regedit.exe).
  2. Navigate to the following key:
     
     HKEY_CURRENT_USER\Software\Microsoft\WindowsNT\CurrentVersion\
     Windows\Run
     
     and remove the entry that refers to "Explore.exe" or _setup.exe."
     
  3. Restart the computer, or kill the process using Task Manager or Process View (if the file is currently in use.)
  4. Delete Explore.exe from the C:\Winnt\System32 folder.

NOTE: For information on file recovery, see the Norton Utilities document Error: "Cannot open file... if part of a ZIP format backup set..." and the Size of Many Files is Zero.

Technical Details