Sender: |
|
Date: |
Mon, 24 Sep 2001 21:10:41 -0400 |
Reply-To: |
|
Subject: |
|
MIME-Version: |
1.0 |
Content-Transfer-Encoding: |
7bit |
Content-Type: |
text/plain; charset="iso-8859-1" |
From: |
|
Comments: |
|
Parts/Attachments: |
|
|
Subject: Re: Virus alert "W32.Vote.A@mm" worm
Yep, it's another one...
Please go to the Symantec website for additional information and removal
instructions
[log in to unmask]" target="_blank">http:[log in to unmask]
Here is an excerpt of the information at the Symantec Antivirus Center:
W32.Vote.A@mm
Discovered on: September 24, 2001
Last Updated on: September 24, 2001 at 09:56:27 AM PDT
W32.Vote.A@mm is a mass-mailing worm that is written in Visual Basic. When
executed, it will email itself out to all email addresses in the Microsoft
Outlook address book. The worm will insert two .vbs files on the system,
and it will also attempt to delete files from several antivirus products.
Type: Worm
Infection Length: 55,808 Bytes
Virus Definitions: September 24, 2001
Payload: Large scale e-mailing: Emails everyone in the Microsoft Outlook
addressbook
Deletes files: After reboot, the worm attempts to delete all files in the
Windows folder
Modifies files: All files with the extension "htm" or "html" will be
overwritten.
Compromises security settings: If the Backdoor.Trojan was successfully
downloaded and installed, anyone could gain full access to the computer.
Distribution:
Subject of email: Fwd:Peace BeTweeN AmeriCa and IsLaM!
Name of attachment: WTC.exe
Size of attachment: 55808 Bytes
Thanks to Val Lawrence, and Mike Kronenfield and Jan Schueller, for the
correct name of this new "virus" worm: "W32.Vote.A@mm" The file it
executes is called WTC.exe, which was the name Elizabeth Mason sent to the
list - so that was pretty close!
***********************************************
The LACTNET mailing list is powered by L-Soft's renowned
LISTSERV(R) list management software together with L-Soft's LSMTP(TM)
mailer for lightning fast mail delivery. For more information, go to:
http://www.lsoft.com/LISTSERV-powered.html
|
|
|