The worm uses standard Windows Mail API to access the user's address book. This affects users of MAPI compatible e-mail clients, mainly Microsoft Outlook.
The e-mails sent by the worm look like this:
From: name-of-the-infected-user
To: random-name-from-address-book
Subject: Fwd:Peace BeTween AmeriCa and IsLaM !
Hi
iS iT waR Against AmeriCa Or IsLaM !?
Let's Vote To Live in Peace!
Attachment: WTC.exe
The following files are deleted from the hard drive:
'C:\Program Files\AntiViral Toolkit Pro\*.*'
'C:\eSafe\Protect\*.*'
'C:\Program Files\Command Software\F-PROT95\*.*'
'C:\PC-Cillin 95\*.*'
'C:\PC-Cillin 97\*.*'
'C:\Program Files\Quick Heal\*.*'
'C:\Program Files\FWIN32\*.*'
'C:\Program Files\FindVirus\*.*'
'C:\Toolkit\FindVirus\*.*'
'C:\f-macro\*.*'
'C:\Program Files\McAfee\VirusScan95\*.*'
'C:\Program Files\Norton AntiVirus\*.*'
'C:\TBAVW95\*.*'
'C:\VS95\*.*'
This way it tries to disable several anti-virus programs.
Trojan installation
The worm opens up two Internet Explorer windows. One is a faked voting booth. The other one tries to download a trojan called Barrio 5.0. The Internet Explorer start page is set to this one.
Barrio trojan is mainly designed for collecting and sending passwords from the victim machine. It can collect dial-up passwords, ICQ UIN and password, etc. and send them to a pre-defined e-mail address.
Script Components
'[windows_dir]\MixDaLaL.vbs' is a Visual Basic Script that searches trough all the available fixed and network drives for .HTM and .HTML files. The content of all these files is replaced with this text:
'AmeRiCa ...Few Days WiLL Show You What We Can Do !!! It's Our Turn
>>> ZaCkEr is So Sorry For You .'
'ZaCker.vbs' is dropped to the windows system directory and added to the registry as:
'[HKLM]\Software\Microsoft\Windows\CurrentVersion\run\Norton.Thar'
so it will be started after the next reboot.
After this it modifies the autoexec.bat so that it would format c: drive after the next reboot. This part of the script is broken so autoexec.bat will be empty. It tries to reboot the system that will not happen since the program called for reboot was just deleted.
Dropped files:
'[windows_dir]\WTC.exe' - worm binary
'[windows_dir]\MixDaLaL.vbs' - HTML destroyer script
'[system_dir]\ZaCker.vbs' - payload (disk eraser)
Added registry key:
'[HKLM]\Software\Microsoft\Windows\CurrentVersion\run\Norton.Thar'
| 