Content-Transfer-Encoding: 7bit
Return-Path: <kitty@jttrotter.com>
Received: from  rly-xf02.mx.aol.com (rly-xf02.mail.aol.com [172.20.105.226]) by air-xf01.mail.aol.com (v80.17) with ESMTP id MAILINXF19-0925134321; Tue, 25 Sep 2001 13:43:21 -0400
Received: from  smtp2.insync.net (smtp2.insync.net [209.113.65.176]) by rly-xf02.mx.aol.com (v80.21) with ESMTP id MAILRELAYINXF21-0925134311; Tue, 25 Sep 2001 13:43:11 -0400
Received: from Kitty (209-113-44-17.insync.net [209.113.44.17])	by smtp2.insync.net (8.11.4/8.11.4) with SMTP id f8PHgqn02661;	Tue, 25 Sep 2001 12:42:52 -0500 (CDT)
Message-ID: <012301c145fc$bbda3700$1c01a8c0@Kitty>
From: "Kitty Kyle" <kitty@jttrotter.com>
To: "Kitty Kyle" <kitty@jttrotter.com>
Subject: NEW VIRUS uses WTC to entice the unwary
Date: Tue, 25 Sep 2001 13:00:26 -0700
MIME-Version: 1.0
Content-Type: text/plain;	charset="iso-8859-1"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.00.2314.1300
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300


 Subject: NEW VIRUS uses WTC to entice the unwary
A new virus called W32.vote.a@mm uses a social a engineering ploy to
entice the recipient to execute it.  The Vote worm is the first virus (of
many
expected viruses) clearly connected to the World Trade Center attack of
September 11. It arrives with an e-mail message containing the following:

    Subject:          Fwd:Peace BeTweeN AmeriCa And IsLaM !
    Body:        Hi
                 iS iT A waR Against AmeriCa Or IsLaM !?
                 Let's Vote To Live in Peace!
    Attachment:       WTC.EXE

 If the user runs the attachment, Vote executes several programs:

      It mass E-mails itself to everyone in you address book

      Them overwrites ALL files ending in .htm or .html with the text:
          AmeRiCa ...Few Days WiLL Show You What We Can Do !!!  It's Our
      Turn >>> ZaCkEr is So Sorry For You .

      Then tries to delete all files in the WINDOWS directory
      add a FORMAT C: (ERASE ALL FILES) command to the AUTOEXEC.BAT file
      display a message box containing the text:
           "I promiss We WiLL Rule The World Again...By The Way,You Are
      Captured By ZaCker !!!"
      and exit Windows.

 The normal TSC E-mail system is protected against this virus BUT if you
 access other E-mail systems either at work or at home, there is a
 possibility you will see this virus and it will most likely be sent from
someone you would recognize.

 Please remember to PRACTICE SAFE COMPUTING by:

      DO NOT OPEN "ENTICING" E-MAILS (From anyone) without checking to make
      sure they actually sent it
      KEEP YOUR ANTI-VIRUS SOFTWARE AND DATA FILES UPDATED (McAfee data
file is currently at DAT 4162)
      IF YOUR COMPUTER STARTS BEHAVING ERRATICALLY - CONTACT YOUR IS PERSON
      ASAP
      BE SURE TO HAVE BACK-UP COPIES OF ALL YOUR FILES

 Also, please remember that THE COMPUTER YOU SAVE MAY BE YOUR OWN.