Return-Path: <sentto-279987-2339-1001419069-fc=all.net@returns.onelist.com> Delivered-To: fc@all.net Received: from 204.181.12.215 by localhost with POP3 (fetchmail-5.1.0) for fc@localhost (single-drop); Tue, 25 Sep 2001 05:00:10 -0700 (PDT) Received: (qmail 4335 invoked by uid 510); 25 Sep 2001 11:59:07 -0000 Received: from n6.groups.yahoo.com (216.115.96.56) by 204.181.12.215 with SMTP; 25 Sep 2001 11:59:07 -0000 X-eGroups-Return: sentto-279987-2339-1001419069-fc=all.net@returns.onelist.com Received: from [10.1.1.221] by hm.egroups.com with NNFMP; 25 Sep 2001 11:58:47 -0000 X-Sender: fc@big.all.net X-Apparently-To: iwar@onelist.com Received: (EGP: mail-7_3_2_2); 25 Sep 2001 11:57:49 -0000 Received: (qmail 74191 invoked from network); 25 Sep 2001 11:57:49 -0000 Received: from unknown (10.1.10.26) by 10.1.1.221 with QMQP; 25 Sep 2001 11:57:49 -0000 Received: from unknown (HELO big.all.net) (65.0.156.78) by mta1 with SMTP; 25 Sep 2001 11:58:46 -0000 Received: (from fc@localhost) by big.all.net (8.9.3/8.7.3) id EAA23659 for iwar@onelist.com; Tue, 25 Sep 2001 04:58:46 -0700 Message-Id: <200109251158.EAA23659@big.all.net> To: iwar@onelist.com (Information Warfare Mailing List) Organization: I'm not allowed to say X-Mailer: don't even ask X-Mailer: ELM [version 2.5 PL1] From: Fred Cohen <fc@all.net> Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com Delivered-To: mailing list iwar@yahoogroups.com Precedence: bulk List-Unsubscribe: <mailto:iwar-unsubscribe@yahoogroups.com> Date: Tue, 25 Sep 2001 04:58:46 -0700 (PDT) Reply-To: iwar@yahoogroups.com Subject: [iwar] [fc:New.'War.Vote'.Virus.Deletes.Computer.Files] Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit New 'War Vote' Virus Deletes Computer Files By Elinor Mills Abreu Reuters SAN FRANCISCO (Sept. 24) - Security experts on Monday warned of a brand new virus masquerading as a program that will allow people to vote whether the United States should go to war over the deadly Sept. 11 hijacker attacks, but which deletes computer files instead. The "Vote Virus" is spreading via e-mail to users of Microsoft Corp.'s Outlook e-mail program, said Simon Perry, vice president of security solutions at Computer Associates International Inc. The virus appears with the subject line: "Peace between America and Islam!" and the body of the e-mail reads: "Hi. Is it a war against America or Islam!? Let's vote to live in peace!" Perry said. When the attachment entitled "WTC.exe" is opened, the virus deletes all the files on the computer's hard drive and sends copies of the e-mail to every address listed in the computer's address book, he said. The virus also defaces any Web pages that are hosted by an infected computer to read: "America ... few days will show you what we can do!!! It's our turn Zaker is so sorry for you." The virus is believed to be the work of an opportunist and not associated with the Sept. 11 jetliner attacks on the World Trade Center and Pentagon in which more than 6,000 people are believed to be dead or missing. "There is no evidence that this is related to the people who carried out" the attacks, Perry said. "We feel this is likely to get quite a high pickup in that a lot of people are going to click on this," he said. "If the news about this doesn't get out before people get their e-mails, they're at risk." SICK SENSE OF HUMOR Perry said he expects there will be more socially engineered viruses created in the future that will take advantage of people's interest in the attacks and the subsequent political and military repercussions. "What this is is a sick sense of humor," Perry said. "Chances are this is not any kind of cyber-terrorism. It's just cyber terror." As many as 10 large corporate customers of Computer Associates have been infected since the virus first appeared Monday morning, Perry said. Researchers do not know where it originated from but it has not yet hit Europe and Asia, he said. Computer Associates is working on software that will enable its Innoculate anti-virus software to detect the new virus and prevent it from infecting a computer, Perry said. ------------------------ Yahoo! Groups Sponsor ---------------------~--> Pinpoint the right security solution for your company- Learn how to add 128- bit encryption and to authenticate your web site with VeriSign's FREE guide! http://us.click.yahoo.com/JNm9_D/33_CAA/yigFAA/kgFolB/TM ---------------------------------------------------------------------~-> ------------------ http://all.net/ Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
This archive was generated by hypermail 2.1.2 : 2001-09-29 21:08:49 PDT