Tweet
now look out for W32.Vote.A@mm worm!
W32.Vote.A@mm is a mass-mailing worm written in the Visual Basic language. It requires the file Msvbvm50.dll to execute.
When executed, the worm will attempt to email itself to all contacts in the Microsoft Outlook address book. The email will appear as follows.
Subject: Fwd:Peace BeTweeN AmeriCa and IsLaM!
Message:
Hi
iS iT A waR Against AmeriCa Or IsLaM !?
Let's Vote To Live in Peace!
Attachment: WTC.EXE
Next, the worm will insert two .vbs files on the system:
\<Windows folder>\ZaCker.vbs
\<Windows\System folder>\MixDaLaL.vbs
In addition, the worm will attempt to download and execute a file. This file is detected as Backdoor.Trojan by Norton Antivirus.
Finally, the worm will attempt to delete all files from several folders. These folders appear to be the default installation folders for several antivirus products. For Norton AntiVirus, this worm will only attempt to delete the files if Norton Antivirus is located in C:\Program Files\Norton AntiVirus.
full text at http://www.symantec.com/avcenter/ven...vote.a@mm.html
When executed, the worm will attempt to email itself to all contacts in the Microsoft Outlook address book. The email will appear as follows.
Subject: Fwd:Peace BeTweeN AmeriCa and IsLaM!
Message:
Hi
iS iT A waR Against AmeriCa Or IsLaM !?
Let's Vote To Live in Peace!
Attachment: WTC.EXE
Next, the worm will insert two .vbs files on the system:
\<Windows folder>\ZaCker.vbs
\<Windows\System folder>\MixDaLaL.vbs
In addition, the worm will attempt to download and execute a file. This file is detected as Backdoor.Trojan by Norton Antivirus.
Finally, the worm will attempt to delete all files from several folders. These folders appear to be the default installation folders for several antivirus products. For Norton AntiVirus, this worm will only attempt to delete the files if Norton Antivirus is located in C:\Program Files\Norton AntiVirus.
full text at http://www.symantec.com/avcenter/ven...vote.a@mm.html