Deadly ExploreZip worm re-emerges in compressed format.

EXPLOREZIP, THE WORM that devastated systems in June, is now back in a compressed version that is slipping through anti-virus security systems.

The worm shut down systems at several major companies last week.

Dubbed MiniZip by some security vendors, the latest outbreak uses the same technology as ExploreZip, the only difference being that it has been compressed in a format that masks it from security systems that scan incoming messages for attacks.

While many anti-virus applications now scan compressed files (and all scan for ExploreZip), the creator of MiniZip used the shareware compression system Neolite to render it invisible to anti-virus security systems.

"[ExploreZip] hasn't been altered at all. All someone did was store it in a very unusual compression format called Neolite," said Dan Schrader, vice president of new technology at security company Trend Micro. "We already scan for compressed files, but they chose one that we don't [scan for] so far."

Security firms such as Symantec, Network Associates, Trend Micro, and Computer Associates received copies of the compressed worm from several infected Fortune 500 companies last Tuesday.

...