1. Symantec/
  2. Security Response/
  3. Worm.ExploreZip

Worm.ExploreZip - Removal

Risk Level 1: Very Low

June 6, 1999
May 1, 2007 10:34:31 AM
Also Known As:
I-Worm.ZippedFiles [Kaspersky], Win32/ExploreZip.Worm [Computer Associates], W32/ExploreZip@MM [McAfee]
Infection Length:
210,432 bytes
Systems Affected:
Symantec Security Response has provided a small utility named FixExzip.exe to remove the virus from memory and undo the changes made by the worm. Please click here to obtain this tool. This is the recommended method for removing this worm.

If you want to remove this worm manually, follow these steps:
  • If you are running Windows 95/98:
    1. Open the Win.ini file in a text editor such as the System Configuration Editor (Sysedit.exe).
    2. Remove the command C:\Windows\System\Explore.exe or C:\Windows\System\_Setup.exe from the run= line.
    3. Restart the computer.
    4. Delete Explore.exe from the C:\Windows\System folder.
  • If you are running Windows NT:
    1. Start the Registry Editor (Regedit.exe).
    2. Navigate to the following key:


      and remove the entry that refers to "Explore.exe" or _setup.exe."
    3. Restart the computer, or kill the process using Task Manager or Process View (if the file is currently in use.)
    4. Delete Explore.exe from the C:\Winnt\System32 folder.

NOTE: For information on file recovery, see the Norton Utilities document Error: "Cannot open file... if part of a ZIP format backup set..." and the Size of Many Files is Zero.
Writeup By: Eric Chien

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube