----- Forwarded message from ITP Lists <[EMAIL PROTECTED]> ----- Date: Tue, 25 Sep 2001 11:15:37 -0600 (MDT) From: ITP Lists <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Subject: Vote virus To: itp mailing list <[EMAIL PROTECTED]> Be aware of the latest virus. How it works Vote arrives as an e-mail with the following information: Subject: Fwd: Peace BeTween AmeriCa And IsLam Body: Hi! iS iT A waR Against AmeriCa Or IsLam! Let's Vote To Live in Peace! Attached: WTC.EXE If the attached file is opened, Vote will install two .vbs files on the hard drive. MixDaLaL.vbs will attempt to overwrite all files ending with .htm or .html with the following phrase: AmeRiCa ...Few Days WiLL Show You What We Can Do !!! It's Our Turn > > > ZaCkEr is So Sorry For You. The second .vbs file, ZaCker.vbs, will add a line to the registry that will run the vbs script the next time the computer is rebooted. ZaCker.vbs attempts to delete all files in the Windows directory and add a Format C: command to the autoexec.bat file. It will also display the following message: I promiss We WiLL Rule The World Again...By The Way,You Are Captured By ZaCker!!!" Removal Antivirus software companies are in the process of updating their signature files to include Vote. For more information on removing Vote from your system, see McAfee, Symantec, and Trend Micro. +------------------------------------------------------------------------+ [EMAIL PROTECTED] University of Colorado Interdiscplinary Telecommunications Program CU-ITP Electronic Mailing List Administration Account Please mail [EMAIL PROTECTED] for information about the ITP http://itp.colorado.edu/TSO +------------------------------------------------------------------------+ ----- End forwarded message -----
