You're in: Panda Security > Home Users > security-info > about-malware > encyclopedia > overview
Active Scan. Scan your PC free
Panda Security Product Line 2012

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Encyclopedia GetVirusCard True 0

Vote.A

 
Threat LevelModerate threatDamageHighDistributionNot widespread
Common name:Vote.A
Technical name:W32/Vote
Threat level:Low
Alias:Vote, Vote.A-mm
Type:Worm
Subtype:Trojan
Effects:  It formats the c: drive, drops a Trojan in the system and overwrites files with a HTM or HTML extension. It also changes the home page in Internet Explorer. It tries to delete antivirus programs.

Affected platforms:

Windows XP/2000/NT/ME/98/95

First detected on:
Detection updated on:Nov. 25, 2003
StatisticsNo
Yes, using TruPrevent Technologies
Repair utility:Panda QuickRemover

Brief Description 

    

Vote is a worm that spreads in a file called WTC.EXE attached to an e-mail message with the subject: Fwd: Peace BeTweeN AmeriCa And IsLaM !.

Vote carries out several actions in the affected computer, some of which are extremely destructive:

  • It formats the C: drive, in other words, deletes its content.
  • It drops a Trojan in the system (Trjan/PSW.Barrio.50).
  • It overwrites files with a HTM or HTML extension.
  • It deletes certain antivirus programs.
  • It changes the home page in Internet Explorer.
 

Visible Symptoms 

    

The first clear indication that you have received Vote is an e-mail with the following characteristics:

  • Subject:
    Fwd: Peace BeTweeN AmeriCa And IsLaM !
  • Message:
    Hi iS iT A waR Against AmeriCa Or IsLaM!? Let's Vote To Live in Peace!
  • Attachments:
    WTC.EXE

The worm also changes the home page inInternet Explorer to :

http://us.f1.yahoofs.com/users/da36d538/bc/TimeUpdate.exe?bcaVq97ATaW0yAxk

Finally, the virus displays the following message on screen :

If the user clicks on the OK button in this window, Vote shuts down the computer.

This action may not be carried out because the worm may have deleted the files needed to do this from the C:\Windows directory.