posted on September 26, 2001 06:54:45 AM new
http://www.cnn.com/2001/BUSINESS/asia/09/26/sf.votevirus/index.html
SAN FRANCISCO -- Computer security experts are warning of a new mass-mailing worm that deletes files while masquerading as a political poll.
The "Vote Virus," which so far is not widespread, targets users of Microsoft's Outlook program and arrives in an email with the subject line "Fwd:Peace BeTweeN AmeriCa and IsLaM!"
The virus is believed to be the work of an opportunist and not associated with the September 11 airline attacks on the World Trade Center and Pentagon.
Open and delete
The body of the email reads: "Hi. Is it a war against America or Islam!? Let's vote to live in peace!" and bears the attachment, "wtc.exe."
The email should be deleted without opening the attachment, experts say.
If the attachment is opened, the worm tries to delete all the files on the infected PC's hard drive and send copies of the email to every address listed in the computer's address book.
The worm also defaces any Web pages that are hosted by an infected computer to read: "America… few days will show you what we can do!!! It's our turn >>> ZaCker is so sorry for you."
The computer infection, which is a worm because of its self-propagation capabilities, also deletes Windows directory files, tries to download a "backdoor" on the computer and unsuccessfully attempts to reformat the system, said Vincent Gulloto, senior research director of Network Association's Antivirus Response Team.
A "backdoor" would enable someone to get remote access to the computer without permission.
The worm can delete ant-virus software on the computer, according to Vincent Weafer, director of Symantec's Antivirus Research Center.
Researchers are worried that the new, dangerous worm might spread quickly because of its supposed relation to the debate over U.S. retaliation for the attacks.
"We feel this is likely to get quite a high pickup in that a lot of people are going to click on this," said Simon Perry, vice president of security solutions at Computer Associates International.
"If the news about this doesn't get out before people get their emails, they're at risk."
