NewsMax.com Wires
Tuesday, Sept. 25, 2001

Infected e-mails carry a "WTC.exe" attachment, according to TrendMicro, an anti-virus software vendor in Cupertino. The file's name is the acronym for the World Trade Center in New York. Other anti-virus vendors, including Cupertino-based Symantec, have given the virus names such as "W32.Vote.A" and "TROJ_VOTE.A."

The CERT Coordination Center, an organization at Carnegie Mellon University in Pittsburgh that studies computer vulnerabilities and disseminates warning information, said it was aware of the virus and is monitoring the situation.

The infected e-mail's subject line reads "Peace BeTween AmeriCa And IsLam!" and the message reads as follows: "Hi! iS iT A waR Against AmeriCa Or IsLam! Let's Vote To Live in Peace!"

Anti-virus specialists said the use of such language, playing on fears about the "war on terrorism," is meant to trick users into forgetting the cardinal rule of computer safety: Do not open strange attachments. If users click on the WTC.exe icon, the virus goes to work.

The virus is particularly dangerous, forcing a computer to format the machine's hard drive that uses the "c:\" identifier, or to delete certain system files and anti-virus definition files. While today's personal computers usually have several hard drive identifiers, the c:\ drive is the usual location for the most important system files; altering it could cripple a computer.

Formatting will occur when the PC is restarted, a common "cure" for virus attacks, and will erase all the information on the drive. Both TrendMicro and Symantec said users should avoid restarting PCs that appear infected. Downloading the latest virus definition files and running an anti-virus program should clear out the problem, they said.

The virus also will mail out copies of itself to everyone in the user's Outlook address book. It attempts to download a separate program to leave the infected PC open to future attacks, Symantec said. In some cases, the virus will alter Internet files ending in ".htm" or ".html" to display this message: "AmeRiCa ...Few Days WiLL Show You What We Can Do !!! It's Our Turn ZaCkEr is So Sorry For You."

The virus is written in such a way that many security programs do not recognize it as dangerous without updated information, several companies said. The good news is that rates of infection seem to be very low because the recent "Nimda" worm attack prompted most corporate networks to disable attachments, preventing the "WTC.exe" file from spreading the virus.

The virus displays several hallmarks of an unskilled hacker, such as repackaging other attacks, the companies said. This reduces the possibility of the virus being connected with other recent incidents, such as "Nimda."

Copyright 2001 by United Press International. All rights reserved.

A product that might interest you:
Get Chris Ruddy and Carl Limbacher`s Special Report on Hillary Clinton