From: "Bill Fox" <>
Subject: [NEWGEN] Fw: Trend Micro Medium Risk Virus Alert - TROJ_VOTE.A
Date: Mon, 24 Sep 2001 17:32:09 -0500
Bill Fox
----- Original Message -----
From: "Trend Virus Info" <>
To: <>
Sent: Monday, September 24, 2001 3:57 PM
Subject: Trend Micro Medium Risk Virus Alert - TROJ_VOTE.A
: Trend Micro Medium Risk Virus Alert - TROJ_VOTE.A
:
: Dear Trend Micro Customer:
:
: TROJ_VOTE.A is currently spreading in-the-wild. This destructive,
mass-mailing Trojan was created using Visual Basic 5. It propagates
via Microsoft Outlook by sending emails to all addresses listed in an
infected user's address book. It arrives in an email with the
following:
:
: Subject: Fwd: Peace BeTween AmeriCa And IsLam !
:
: Message Body: Hi! iS iT A waR Against AmeriCa Or IsLam! Let's Vote
To Live in Peace!
:
: Attachment: WTC.EXE
:
: TROJ_VOTE.A deletes certain antivirus products installed in a
system, drops the files WTC.exe MixDaLaL.vbs, and Zacker.vbs. It also
modifies the infected user's Internet Explorer startup page, and
formats the infected user's drive c:\.
:
: It parses drives and directories in search of HTM and HTML files and
overwrites them with the following string: AmeRiCa ...Few Days WiLL
Show You What We Can Do !!! It's Our Turn >>> ZaCkEr is So Sorry For
You.
:
: TROJ_VOTE.A is detected by pattern file #945.
:
: For more information on TROJ_VOTE.A please visit our Web site at:
:
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=TROJ_VO
TE.A
:
:
:
**********************************************************************
********************
: You are receiving this email from Trend Micro, because you have
either
: downloaded a Trend Micro product or have signed up for our "Virus
: Alerts." If you would like to change the way you receive email from
: Trend Micro please make changes in your account page at
:
http://www.antivirus.com/subscriptions/default.asp?email= type="text/javascript">DisplayMail('nightowl','bfox');
.net
:
: To UNSUBSCRIBE go to:
:
http://www.antivirus.com/subscriptions/default.asp?format=unsubscribe
:
: For questions regarding viruses, please contact the Virus Doctor at
: .
:
: For questions regarding products, please contact Tech Support at
: .
:
**********************************************************************
*********************
:
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.281 / Virus Database: 149 - Release Date: 9/19/01