W32.Vote - Anti_TeRRoRisM.exe (B)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Vote

Sender:

Varies.  Usually someone you know.

Subject:

Fwd:PEaCe BetWeen AmeRiCa And ISLaM !
Fwd:This War Must Be Done! (B)
(Recipients.name), WORLD TRADE CENTER PICTURES (D)
(Recipients.name), (Random message) (E)
THE WAR HAS STARTED ! (K)

Message:

HiiS iT A waR Against AmeriCa Or IsLaM !?Let's Vote To Live in Peace!
HiWe Must Fight , We Must ReMemBer Our Victims!No Peace Before
KiLLing TeRRoRists ! (B)
(Recipients.name), Remember The Times.......MAYBE THEY WILL BE
BACK....!!! (D)
(Recipients.name), THE WAR IS NOT A JOKE !...THERE IS ONE BUILDING UP
RIGHT NOW. Let's Unite In This Horrible Kaos. ...Fight With Us....!!!
...And Let Us Remember Those Lost Souls !WE COUNT ON YOU
!Greetings,World War Veterans.PS- See Attachments For War Info. (E)

Attachment:

Anti_TeRRoRisM.exe (B)
Plug-In_EXT.dll (E)
USA.VS.IRAQ.scr (E)
WTC.EXE
WTC32.scr (D)

Comments: A mass-mailing worm that emails itself to all email addresses in the Microsoft Outlookaddress book.Attempts to spread through the KaZaA file-sharing network (K)

Symptoms:


 Files with the extensions extensions .htm or .html. are overwritten
with the message: AmeRiCa ...Few Days WiLL Show You What We Can Do !!!
It's Our Turn >>> ZaCkEr is So Sorry For You 
 ZaCker = %WindowsSystem%DaLaL.vbs is added to the registry key
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun so that
the file is executed when you start Windows. 
 Finally, displays the message: I promiss We WiLL Rule The World
Again...By The Way, You Are Captured By ZaCker!!! 
 Will also attempt to delete files from several antivirus products
(A) 
 Changes the Microsoft Internet Explorer home page to: about: I
SwEar, We WiLL Rule This World SooN !!! (B) 
 Changes the value to: Start Page c:windowsWTC32.scr in the registry
key: HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain (E) 
 Displays the message titled WORLD TRADE CENTER: 
 WE WILL ALWAYS REMEMBER THOSE LOST SOULS (K)

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Run LiveUpdate to make sure that you have the most recent virus definitions.
Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. Forinstructions on how to do this, read the document How to configure Norton AntiVirus to scanall files.
Run a full system scan.
Delete all files that are detected as W32.Vote.gen@mm, W32.Vote.A@mm, or W32.Vote.B@mm.
Reset the Internet Explorer home page
Reverse the changes made to the registry. Restore the files that the worm overwrote from aclean backup.
If the computer was restarted after the infection, or if the computer seems very unstable,reinstall the operating system.