Quote:
W32.Vote.D@mm is a mass mailing worm that attempts to use Microsoft Outlook to email itself to all the contacts in the Windows Address Book. It also attempts to overwrite and delete numerous files on the infected system.
The email has the following characteristics:
Subject: <Recipients.name>, WORLD TRADE CENTER PICTURES
Message: <Recipients.name>, Remember The Times.......MAYBE THEY WILL BE BACK....!!!
Attachment: WTC32.scr
This threat is written in Microsoft Visual Basic (VB). The VB run-time libraries must be installed for the worm to execute.
NOTE: Virus definitions dated prior to March 19, 2003 may detect this threat as Bloodhound.W32.VBWORM. Virus definitions dated March 19 may detect this threat as W32.HLLW.Der@mm.
Also Known As: W32.HLLW.Der@mm
Type: Worm
Infection Length: 61,440 bytes
Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected: Windows 3.x, Macintosh, OS/2, UNIX, Linux
And the Payload..
Quote:
Payload:
Large scale e-mailing: Send itself to all the contacts in the Windows Address Book
Deletes files: Deletes all the .wav, .mp3, .jpg, .bmp, .zip, .rar, and .doc files, and overwrites all the .exe and .scr files
Cheers