W32.Vote.a Worm Exploits Recent National Tragedy

September 24, 2001

 TROJ_VOTE.A spreads via the often exploited Microsoft Outlook method using the infected user's address book. It creates havoc on several levels, the worst of which may be the addition of a line in AUTOEXEC.BAT to reformat the C:\ drive so DO NOT reboot from the infected drive!

The message carrying the virus arrives looking like:

Subject: Fwd: Peace BeTween AmeriCa And IsLam !
Message Body: Hi! iS iT A waR Against AmeriCa Or IsLam! Lets Vote To Live in Peace!
Attachment: WTC.EXE

Reference and manual cleaning instructions can be found here: http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=TROJ_VOTE.A