W32.Vote.D@mm

W32.Vote.D@mm is a mass mailing worm that attempts to use Microsoft Outlook to email itself to all the contacts in the Windows Address Book. It also attempts to overwrite and delete numerous files on the infected system.

The email has the following characteristics:

Subject: <Recipients.name>, WORLD TRADE CENTER PICTURES
Message: <Recipients.name>, Remember The Times.......MAYBE THEY WILL BE BACK....!!!
Attachment: WTC32.scr

This threat is written in Microsoft Visual Basic (VB). The VB run-time libraries must be installed for the worm to execute.

NOTE: Virus definitions dated prior to March 19, 2003 may detect this threat as Bloodhound.W32.VBWORM. Virus definitions dated March 19 may detect this threat as W32.HLLW.Der@mm.

Protection

• Initial Rapid Release version March 19, 2003
• Latest Rapid Release version July 19, 2008 revision 019
• Initial Daily Certified version March 19, 2003
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date March 19, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: High

Distribution

• Distribution Level: High