[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

new virus



Colleagues:

Just received this information from our MIS Dept. though that you might
could use it.

Russell P. Baker, CA
Arkansas History Commission and State Archives
One Capitol Mall
Little Rock, AR 72201
501-682-6900
russell.baker@mail.state.ar.us <mailto:russell.baker@mail.state.ar.us>

There is a new Virus asking you to Vote To Live in Peace. It has a subject:
Peace BeTweeN AmeriCa and IsLaM!. Delete the e-mail and be aware there may
be more to come so if you receive any e-mail from someone you do not know,
or an e-mail that request you to vote on anything, or has patriotic
overtones, delete the e-mail.
Subject: Fwd:Peace BeTweeN AmeriCa and IsLaM!

Message:
Hi
iS iT A waR Against AmeriCa Or IsLaM !?
Let's Vote To Live in Peace!
W32.Vote.A@mm is a mass-mailing worm that is written in Visual Basic. When
executed, it will email itself out to all email addresses in the Microsoft
Outlook address book. The worm will insert two .vbs files on the system, and
it will also attempt to delete files from several antivirus products.
Type: Worm <http://www.symantec.com/avcenter/refa.html>
Infection Length: <http://securityresponse.symantec.com/avcenter/refa.html>
55,808 Bytes
Virus Definitions: <http://securityresponse.symantec.com/avcenter/refa.html>
September 24, 2001
Threat Assessment: <http://securityresponse.symantec.com/avcenter/refa.html>

 <<...OLE_Obj...>>       <<...OLE_Obj...>>       <<...OLE_Obj...>>

Wild <http://www.symantec.com/avcenter/refa.html>:  Low         Damage
<http://www.symantec.com/avcenter/refa.html>:  High     Distribution
<http://www.symantec.com/avcenter/refa.html>:  High
 <<...OLE_Obj...>>
Wild: <http://securityresponse.symantec.com/avcenter/refa.html>
*       Number of infections:
<http://securityresponse.symantec.com/avcenter/refa.html> 0 - 49
*       Number of sites:
<http://securityresponse.symantec.com/avcenter/refa.html> 3 - 9
*       Geographical distribution:
<http://securityresponse.symantec.com/avcenter/refa.html> Medium
*       Threat containment:
<http://securityresponse.symantec.com/avcenter/refa.html> Moderate
*       Removal: <http://securityresponse.symantec.com/avcenter/refa.html>
Moderate
Damage: <http://securityresponse.symantec.com/avcenter/refa.html>
*       Payload: <http://securityresponse.symantec.com/avcenter/refa.html>
*       Large scale e-mailing:
<http://securityresponse.symantec.com/avcenter/refa.html> Emails everyone in
the Microsoft Outlook addressbook
*       Deletes files:
<http://securityresponse.symantec.com/avcenter/refa.html> After reboot, the
worm attempts to delete all files in the Windows folder
*       Modifies files:
<http://securityresponse.symantec.com/avcenter/refa.html> All files with the
extension "htm" or "html" will be overwritten.
*       Compromises security settings:
<http://securityresponse.symantec.com/avcenter/refa.html> If the
Backdoor.Trojan was successfully downloaded and installed, anyone could gain
full access to the computer.
Distribution: <http://securityresponse.symantec.com/avcenter/refa.html>
*       Subject of email:
<http://securityresponse.symantec.com/avcenter/refa.html> Fwd:Peace BeTweeN
AmeriCa and IsLaM!
*       Name of attachment:
<http://securityresponse.symantec.com/avcenter/refa.html> WTC.exe
*       Size of attachment:
<http://securityresponse.symantec.com/avcenter/refa.html> 55808 Bytes
Technical description:
<http://securityresponse.symantec.com/avcenter/refa.html>
W32.Vote.A@mm is a mass-mailing worm written in the Visual Basic language.
It requires the file Msvbvm50.dll to execute.

When executed, the worm will attempt to email itself to all contacts in the
Microsoft Outlook address book. The email will appear as follows.

Subject: Fwd:Peace BeTweeN AmeriCa and IsLaM!

Message:
Hi
iS iT A waR Against AmeriCa Or IsLaM !?
Let's Vote To Live in Peace!

Attachment: WTC.EXE

Next, the worm will insert two .vbs files on the system:
*       \<Windows folder>\ZaCker.vbs
*       \<Windows\System folder>\MixDaLaL.vbs

In addition, the worm will attempt to download and execute a file. This file
is detected as Backdoor.Trojan by Norton Antivirus.

Finally, the worm will attempt to delete all files from several folders.
These folders appear to be the default installation folders for several
antivirus products. For Norton AntiVirus, this worm will only attempt to
delete the files if Norton Antivirus is located in C:\Program Files\Norton
AntiVirus.

A posting from the Archives & Archivists LISTSERV List!

To subscribe or unsubscribe, send e-mail to listserv@listserv.muohio.edu
      In body of message:  SUB ARCHIVES firstname lastname
                    *or*:  UNSUB ARCHIVES
To post a message, send e-mail to archives@listserv.muohio.edu

Or to do *anything* (and enjoy doing it!), use the web interface at
     http://listserv.muohio.edu/archives/archives.html

Problems?  Send e-mail to Robert F Schmidt <rschmidt@lib.muohio.edu>