New 'War Vote' Virus Deletes Computer Files

SAN FRANCISCO (Sept. 24) - Security experts on Monday warned of a brand new virus masquerading as a program that will allow people to vote whether the United States should go to war over the deadly Sept. 11 hijacker attacks, but which deletes computer files instead.

The "Vote Virus" is spreading via e-mail to users of Microsoft Corp.'s Outlook e-mail program, said Simon Perry, vice president of security solutions at Computer Associates International Inc.

The virus appears with the subject line: "Peace between America and Islam!" and the body of the e-mail reads: "Hi. Is it a war against America or Islam!? Let's vote to live in peace!" Perry said.

When the attachment entitled "WTC.exe" is opened, the virus deletes all the files on the computer's hard drive and sends copies of the e-mail to every address listed in the computer's address book, he said.

The virus also defaces any Web pages that are hosted by an infected computer to read: "America ... few days will show you what we can do!!! It's our turn >>> Zaker is so sorry for you."

The virus is believed to be the work of an opportunist and not associated with the Sept. 11 jetliner attacks on the World Trade Center and Pentagon in which more than 6,000 people are believed to be dead or missing.

"There is no evidence that this is related to the people who carried out" the attacks, Perry said.

"We feel this is likely to get quite a high pickup in that a lot of people are going to click on this," he said. "If the news about this doesn't get out before people get their e-mails, they're at risk."

SICK SENSE OF HUMOR

Perry said he expects there will be more socially engineered viruses created in the future that will take advantage of people's interest in the attacks and the subsequent political and military repercussions.

"What this is is a sick sense of humor," Perry said. "Chances are this is not any kind of cyber-terrorism. It's just cyber terror."

As many as 10 large corporate customers of Computer Associates have been infected since the virus first appeared Monday morning, Perry said. Researchers do not know where it originated from but it has not yet hit Europe and Asia, he said.

Computer Associates is working on software that will enable its Innoculate anti-virus software to detect the new virus and prevent it from infecting a computer, Perry said.