Win32/Vote.A Worm.

 Information about the Win32/Vote.A worm:

Vote.A is a mass mailing email worm. This worm will infect Windows systems. It spreads through Microsoft Outlook.

The worm arrives with the subject:

Fwd:Peace BeTweeN AmeriCa and IsLaM!

The body of the message reads:

Hi iS iT A waR Against AmeriCa Or IsLaM !? Let's Vote To Live in Peace!

Infected email carries an attachment called WTC.exe. This worm works if file MSVBVM50.DLL resides in the system. When the attachment is executed, it tries to mail itself to all contacts under Microsoft Outlook Addressbook. It drops ZaCker.vbs under Windows directory and MixDaLaL.vbs under Windows\System directory.

The worm tries to execute MixDalaL.vbs, which replaces the contents of all the .HTM and .HTML files in all the fixed drives with the following content:

AmeRiCa ...Few Days WiLL Show You What We Can Do !!! It's Our Turn >>> ZaCkEr is So Sorry For You

The worm alters the following registry key to load ZaCker.vbs during Windows startup

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

When system is restarted it tries to delete all the files under the Windows directory. The worm modifies AUTOEXEC.BAT file to format C: drive during the next startup. It also tries to delete anti-virus related files in the system. After this it displays the following message box.

Vote.A first appeared on 24th September 2001.

Other names of Win32/Vote.A worm:

The worm is also known as TROJ_VOTE.A, W32.Vote.A, VBS/Vote-A, Troj/Barrio.

 Removing Win32/Vote.A worm from your computer:

You can remove this virus from your computer by using Protector Plus antivirus software.