Here is the information that you requested.
Virus Advisories
Virus Encyclopedia
Weekly Virus Report
Virus Primer
Safe Computing Guide
Glossary of Terms
Virus Info Feed
Virus alerts by email
your email
Virus Encyclopedia
TROJ_VOTE.A
Aliases:
W32.Vote.a@mm
Description:
TROJ_VOTE.A is currently spreading in-the-
wild. This destructive, mass-mailing Trojan was created using Visual
Basic 5. It propagates via Microsoft Outlook by sending emails to all
addresses listed in an infected user's address book. It arrives in an email
with the following:
Subject: Fwd:Peace BeTween AmeriCa And IsLam !
Message Body: Hi!
iS iT A waR Against AmeriCa Or IsLam!
Let's Vote To Live in Peace!
Attachment: WTC.EXE
TROJ_VOTE.A deletes certain antivirus products installed in a system,
drops the files WTC.exe MixDaLaL.vbs, and Zacker.vbs. It also modifies
the infected user's Internet Explorer startup page, and formats the
infected user's drive c:\.
It parses drives and directories in search of HTM and HTML files and
overwrites them with the following string:
AmeRiCa ...Few Days WiLL Show You What We Can
Do !!! It's Our Turn >>> ZaCkEr is So Sorry For
You.
This program requires that the Visual Basic Runtime Library
MSVBVM50.DLL is installed in order to execute.
Solution:
1. Run REGEDIT.EXE and delete the registry subkey "Norton.Thar"
in the registry path:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run
2. Using NOTEPAD or any text editor, please remove the instruction
"echo Y | format C".
3. Using Windows Find utility, please search for *.htm and *.html files
which the Trojan may have overwritten. Delete all files found of
100 Bytes (or 1KB as it is be displayed).
4. Scan your system with Trend Micro antivirus and delete all files
detected as TROJ_VOTE.A. To do this Trend Micro customers
Risk rating:
Virus type: Trojan
Destructive: Yes
Page 1 of 2 TROJ_VOTE.A description and solution
9/25/01 http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=TROJ_VOTE.A
-----Original Message-----
From: Alston, Steve [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 25, 2001 12:03 PM
To: NT System Admin Issues
Subject: New virus -- real or hoax?
I got the following note from a friend. Haven't seen any thing to confirm
or deny authenticity. Can anyone shed light on this?
Thanks,
Steve
-----------------------------Attached note--------------------------
There is a new virus circulating that has a subject line containing a
message about peace.
It asks you to vote on whether the United States should retaliate for the
World Trade Center attacks.
It asks you to click on an attachment called WTC.EXE that, if run, CAN
ERASE EVERYTHING ON YOUR COMPUTER!
Want to unsub? Do that here:
http://lyris.sunbelt-software.com/scripts/lyris.pl?enter=ntsysadmin&text_mode=0&lang=english
http://lyris.sunbelt-software.com/scripts/lyris.pl?enter=ntsysadmin&text_mode=0&lang=english
