Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Email-Worm:W32/Vote.B


Aliases:


Email-Worm:W32/Vote.B

Malware
Email-Worm
W32

Summary

This type of worm is embedded in an e-mail attachment, and spreads using the infected computer's e-mailing networks.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

Email-Worm:W32/Vote.B shares similar code to its predecessor, Vote.A, but includes a number of significant differences in function. A more recent variant, Vote.C, combines features of Vote.A and Vote.B. Vote.C is functionally identical to Vote.B, but is propagated via e-mail messages identical to those used to distribute Vote.A.


Propagation

Vote.B propagates in e-mail messages that look like this:

From: name-of-the-infected-user
To: random-name-from-address-book
Subject: Fwd: This War Must Be Done !
Hi We Must Fight , We Must ReMemBer Our Victims!

Attachment: WTC.exe 


Installation

Vote.B drops the following files:

  • [windows_dir]\Anti_TeRRoRisM.exe - worm binary
  • [windows_dir]\MixDaLaL.vbs - HTML destroyer script
  • [system_dir]\DaLaL.vbs - first part of payload
  • [system_dir]\WaiL.vbs - second part of payload

Unlike Vote.A, Vote.B does not try to remove any anti-virus program.


Activity

The payload routine was split to two parts. The first one tries to modify autoexec.bat and registers the second part. Autoexec.bat modification fortunately still does not work. The second part of the script is the one that deletes all the files from Windows folder then displays the following message:


Registry Modifications

Creates these keys:

  • [HKLM]\Software\Microsoft\Windows\CurrentVersion\run\ZaCker
  • [HKLM]\Software\Microsoft\Windows\CurrentVersion\run\ALWaiL






Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.