# MA-011.061999: MyCERT Advisory - Manual Removal of the W32/ExploreZip Worm

**Date:** 16 Jun 1999  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-011.061999  
**Advisory ID:** MA-011.061999

---

This document is a reissue based on some findings by MyCERT on the effectiveness of certain antivirus software.
### For Windows 95/98:
1. Reboot your PC in DOS mode.
- Press F8 until Microsoft Windows Startup Menu appears.
- Select "6. Command prompt only".
2. At **C:\>** prompt, delete the file **Explore.exe**
- **C:\ del c:\windows\system\Explore.exe**
3. Type EDIT c:\windows\win.ini
Remove all
Save the file, ALT-F and Exit.
- - RUN= C:\WINDOWS\SYSTEM\Explore.exe, or
RUN=C:\WINDOWS\\_setup.exe
4. Reboot the PC and go to Windows mode.
5. Go to all shared folder through Windows Explorer and Right Click on it:
Click to **Properties--> Read Only --> Yes**
6. Update your virus definition file of your respective antivirus software and run a virus scan. Ensure your antivirus is running in **Auto Protect Mode** at all times.
7. Antivirus software running auto-protect mode will not be able to detect the worm. Thus it is necessary to set the scanner as a plugin to email software, in order to detect the virus as soon as file attachment is executed. For example:
For Netscape Messenger and Norton Antivirus users, enable the plugin by following the steps below:
1. Go to Start --> Programs --> Norton Antivirus --> Plug in to Netscape Navigator. Tick on "Use Norton Antivirus as a Netscape Plugin". Click on "Check all", then click OK.
2. When sharing folders, DO NOT give Full Access (read & write). Settle for Read Only instead.
### For Windows NT:
In Windows NT, this worm runs as an "**Explore**" process in WinNT Task Manager. You may experience high CPU utilization prior to ending this process.
1. Reboot your PC in DOS mode. Change to the directory WINNT\SYSTEM32\
C:\> cd WINNT\SYSTEM32\
2. Delete the file Explore.exe and exit to Windows Mode.
C:\>del Explore.exe
3. Goto the folder C:\WINNT\ through Windows Explorer and Right Click on it
Click to Sharing -->Click to Not Shared -->Click OK.
4. Run the Win NT registry editor:
Click Start-->Run-->Open REGEDIT (not REGEDT32)
5. Locate the hive
[HKEY\_CURRENT\_USER\Software\Microsoft\WindowsNT\CurrentVersion\Windows].
6. Highlight the following key
"run=C:\WINNT\System32\Explore.exe" , or
"run=C:\WINNT\\_setup.exe"
and remove pressing the **Delete** button.
7. Update your virus definition file of your respective antivirus software and run a virus scan. Ensure your antivirus is running in **Auto Protect Mode** at all times.
8. Antivirus software running auto-protect mode will not be able to detect the worm. Thus it is necessary to set the scanner as a plugin to email software, in order to detect the virus as soon as file attachment is executed. For example:
For Netscape Messenger and Norton Antivirus users, enable the plugin by following the steps below:
1. Go to Start --> Programs --> Norton Antivirus --> Plug in to Netscape Navigator. Tick on "Use Norton Antivirus as a Netscape Plugin". Click on "Check all", then click OK.
2. When sharing folders, DO NOT give Full Access (read & write). Settle for Read Only instead.