|
Virus Name- Don't Take Part in This Election - PE_VOTE.E (Low Risk)
This memory-resident variant of PE_VOTE.D overwrites target files with WAV, MP3, JPG, BMP, ZIP, RAR, and DOC extensions. It runs on Windows 95, 98, ME, NT, 2000, and XP.
It arrives in an email with the following details:
Subject: , %string% THE WAR HAS STARTED !
where %string% is any of the following:
- LET US UNITE,
- NOW OUR MISSION: DEATH ?
- THE WORLD WAR THREE IS HERE !
- REMEMBER OUR LOST SOULS !
- WAR SCENES FROM IRAQ !
- WORLD TRADE CENTER, REVENGE !
- IRAQ WITHOUT ELECTRICITY ?
- IRAQ, GETTING STRONGER OR WEAKER ?
- IRAQ SURRENDERING !?
- USA PREPARED FOR ATTACKS,
Message Body: , THE WAR IS NOT A JOKE !... THERE IS ONE BUILDING UP RIGHT NOW
Let's Unite In This Horrible Kaos. Win2K... Fight With Us....!!! ...And Let Us Remember Those Lost Souls ! WE COUNT ON YOU ! Win2K Greetings,
World War Veterans.
PS- See Attachments For War Info.
Attachments:USA.VS.IRAQ.scr
Plug-In_EXT.dll
When the attachments are executed, it displays a message box which reads, "World Trade Center. WE WILL ALWAYS REMEMBER THOSE LOST SOULS."
Then it displays another message box, which differs with each infection. A sample message it displays is as follows:
Title: VICTIM # 4574
Message: I WAS F**KING MY STEP MOTHER
WHILE SHE SCREAMED : WATCH OUT FOR THAT PLANE...!
After displaying the messages, it executes its mass-mailing routine and then overwrites its target files.
10 Most Prevalent In-the-Wild Malware Surveyed by Trend Micro US(week of: May 19, 2003 to May 25, 2003)
1. WORM_SDDROP.C
2. JS_EXCEPTION.GEN
3. WORM_KLEZ.H
4. JS_NOCLOSE.E
5. WORM_LOVGATE.F
6. TROJ_SMALL.M
7. WORM_SDDROP.A
8. WORM_FIZZER.A
9. WORM_KWBOT.C
10. WORM_SOBIG.B
For more information, please visit any of the Anti-virus companies below. Only three are given. |
