W32/Vote (Varianten .a, .b & . - Malware

See also

Full description

Alias:
Type:	Worm
Size:	55,808 Bytes
Origin:
Date:	09-24-2001
Damage:	Sent by email.
VDF Version:	6.23.00.00
Danger:	Medium
Distribution:	Low

DistributionW32.Vote is a mass mailer, written in Visual Basic. It spreads using Microsoft Outlook, sending itself to all addresses found in the Address Book.
The email's structure:
Subject: Fwd:Peace Be Tween AmeriCa And IsLam!
Body: Hi! iS iT A waR Against AmeriCa Or IsLam! Let`s Vote To Live in Peace! Attachement: WTC.EXE

Technical DetailsIf the attacment WTC.EXE is opened, W32.Vote.a creates the following files:

C:\%WinDIR%\WTC.EXE
C:\%WinDIR%\%SystemDIR%\ZACKER.VBS
C:\%WinDIR%\%SystemDIR%\MIXDALAL.VBS

Then it enters the registry key, to be automatically started:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run\] "Norton.Thar"="C:\\%WinDIR%\\%SystemDIR%\\ZaCker.vbs"

W32.Vote.a

W32.Vote.a modifies AUTOEXEC.BAT and inserts the command "format c:". When the system is restarted, the drive C:\ is formatted. If Windows is completely installed, it runs the file ZACKER.VBS and deletes all files from Windows directory. Then, the following message is seen:
"I promiss We WiLL Rule The World Again... By The Way, You Are Captured By ZaCker !!! "
After modifying the registry and AUTOEXEC.BAT, the worm terminates the Internet Explorer start site. Then, it starts the Internet Explorer and automatically launches a program named TimeUpdate.exe from the Internet. The start site of Internet Explorer is changed into the following URL:
http://us.f1..com/users/da26d538/bx/TimeUpdate.exe?bcaVq97AtaW0yAxk
W32.Vote.a launches the VBS script MIXDALAL.VBS. This Visual Basic script searches on the local and mapped drives for .HTM and .HTML files and replaces their contents with the following text:
"AmeRiCa ...Few Days WiLL Show You What We Can Do !!! It's Our Turn >>> ZaCkEr is So Sorry For You."

W32.Vote.b

Version 2 of W32.Vote installs the following files on the computer:
C:\%WinDIR%\ANTI_TERRORISM.EXE
C:\%WinDIR%\MIXDALAL.EXE
C:\%WinDIR%\%SystemDIR%\DALAL.EXE
C:\%WinDIR%\%SystemDIR%\WAIL.EXE
Unlike Version a, this version makes the following registry entry:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "ZACker"="C:\\%WinDIR%\\%SystemDIR%\\DaLaL.vbs"
and the start site of Internet Explorer is changed into the following URL:
"about:I SwEar , We WiLL Rule This World SooN !!!"

W32.Vote.c

Version c creates the following files:
C:\%WinDIR%\WTC.EXE
C:\%WinDIR%\MIXDALAL.EXE
C:\%WinDIR%\%SystemDIR%\DALAL.EXE
C:\%WinDIR%\%SystemDIR%\WAIL.EXE
and the start site of Internet Explorers is changed into the following URL: http://us.f1..com/users/da36d538/bc/

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back