This type of worm is embedded in an e-mail attachment, and spreads using the infected computer's e-mailing networks.
If the worm has been activated once the system must not be restarted before it is properly cleaned; otherwise, the payload will be triggered.To clean the system, the following actions should be taken:
Email-Worm:W32/Vote is a family of e-mail worms that use the September 11 terrorist attacks as a ploy to get people to execute it. The worms are written in Visual Basic.On execution, Vote will attempt to download a trojan onto the machine in addition to propagating itself. The worm also includes a number of dangerous routines.The details below describe the Vote.A variant. For more details of the other variants, please see:
Vote.A was first reported on the 24th of September, 2001 - 13 days after the WTC tragedy. It appears to be written by a teenager.
The worm uses standard Windows Mail API to access the user's address book. This affects users of MAPI compatible e-mail clients, mainly Microsoft Outlook. The e-mails sent by the worm look like this:
From: name-of-the-infected-user To: random-name-from-address-book Subject: Fwd:Peace BeTween AmeriCa and IsLaM ! Hi iS iT waR Against AmeriCa Or IsLaM !? Let's Vote To Live in Peace! Attachment: WTC.exe
If the e-mail file attachment is run, the worm is executed and drops the following files on the system:
The main worm executable (WTC.exe) then deletes a variety of files from the system in order to try and disable several antivirus programs.
The other two files dropped by the worm are scripts. '[windows_dir]\MixDaLaL.vbs' is a Visual Basic Script that searches through all the available fixed and network drives for .HTM and .HTML files. The content of all these files is replaced with this text:
ZaCker.vbs first deletes all files from the Windows folder. It then displays a message:
After displaying the message, the script modifies the autoexec.bat file in order to format the C: drive after the next reboot. This part of the script is broken, resulting in the autoexec.bat being empty. The script's attempt to reboot the system fails as the program called for reboot is deleted. While active, the worm opens two windows in the Microsoft Internet Explorer web browser. The first is a faked voting booth. The second page is set to download a trojan called Barrio 5.0. The browser's start page is also set to this second page.If successfully downloaded, the Barrio trojan collects passwords (dialup, ICQ, UIN, etc) and fowards them to a pre-defined e-mail address.
The 'ZaCker.vbs script adds the following registry key to ensure it is started on the next system reboot:
Once installed, the worm changes the startup page of Internet Explorer to point to the worm's file at "c:\Windows\WTC32.scr". After performing its mass-mailing routine, the worm displays one or more message boxes with different messages, for example:
Some of these messages are very insulting and contain bad language.The worm's payload also includes dangerous routines. These are:
Removes these files:
Description Created: 2010-07-29 09:07:43.0
Description Last Modified: 2010-07-30 04:56:12.0