Trend Micro Medium Risk Virus Alert - TROJ_VOTE.A
Dear Trend Micro Customer:
TROJ_VOTE.A is currently spreading in-the-wild. This destructive, mass-mailing Trojan was created using Visual Basic 5. It propagates via Microsoft Outlook by sending emails to all addresses listed in an infected user’s address book. It arrives in an email with the following:
Subject: Fwd: Peace BeTween AmeriCa And IsLam !
Message Body: Hi! iS iT A waR Against AmeriCa Or IsLam! Let’s Vote To Live in Peace!
Attachment: WTC.EXE
TROJ_VOTE.A deletes certain antivirus products installed in a system, drops the files WTC.exe MixDaLaL.vbs, and Zacker.vbs. It also modifies the infected user’s Internet Explorer startup page, and formats the infected user’s drive c:\.
It parses drives and directories in search of HTM and HTML files and overwrites them with the following string: AmeRiCa ...Few Days WiLL Show You What We Can Do !!! It's Our Turn >>> ZaCkEr is So Sorry For You.
TROJ_VOTE.A is detected by pattern file #945.
For more information on TROJ_VOTE.A please visit our Web site at:
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=TROJ_VOTE.A
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm-----Original Message-----
From: Ziminski, Rick (Rick)** CTR ** [mailto:[EMAIL PROTECTED]]
Sent: Monday, September 24, 2001 4:32 PM
To: NT System Admin Issues
Subject: New virus on the loose
A new virus called W32/Vote@MM has been reported to be circulating around the Internet. If you receive an email with the Subject: "Fwd:Peace BeTweeN AmeriCa And IsLam!", delete the email and do not open the "wtc.exe" attachment. Executing the "wtc.exe" attachment will format your C-drive and destroy your data.
Rick
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
rzski@hotmail
