BadTrans@mm

Name: W32/Badtrans.B@mm
Aliases: WORM_BADTRANS.B, W32.Badtrans.B@mm, BadTrans.B, W32/Badtrans-B, W32/Badtrans.B
Type: Internet Worm
Discovery Date: November 24, 2001

Description:

W32/Badtrans.B@mm is a mass-mailing worm that infects Win32 systems. This worm arrives as an email attachment using one of several different filenames as well as two separate extensions; for example, YOU_ARE_FAT!.MP3.scr.

When the worm is executed, it will install a copy of itself as kernel32.exe on the Windows System directory. It then adds the following registry key:

HKLM\Software\Microsoft\Windows\RunOnce\kernel32 = "kernel32.exe"

1. Open the Command AntiVirus� graphical user interface (GUI).
2. On the menu bar, click Preferences, and then Active Protection.
3. Under Action on infection, select Disinfect, and click OK.
4. Close the Command AntiVirus GUI.
5. Shut down your computer.
6. Turn on your computer to restart.
7. When the restart is complete, shut down your computer.
8. Turn on your computer to restart again letting Windows� start normally. NOTE: This second restart is absolutely necessary.
9. Open the Command AntiVirus GUI.
10. In the Task List, select Scan Hard Drives.
11. Click the Properties button.
12. Under Action to take, select Disinfect.
13. Under File types to scan, select All files, and click OK.
14. Click the Execute Task button.

Name: W95/Badtrans.A@mm
Aliases: BadTrans, W32/BadTrans@MM, W32.BadTrans.13312@mm, W32/BadTrans-A, Troj_BadTrans.A
Type: Internet Worm
Discovery Date: April 12, 2001

Description:

W95/Badtrans.A@mm is a mass-mailing internet worm with a remote access trojan component. When executed, the worm makes a copy of itself named "inetd.exe" and puts it into the Windows directory. It also drops the trojan file, named "kern32.exe", and a keylogger DLL, named "hksdll.dll", into the Windows System directory. When this process is complete, an "Install Error" box with the message "File data corrupt: probably due to bad transmission or bad disk access" will be displayed.



The next time the computer is restarted, the worm will use MAPI to reply to all unread email messages by sending itself as an attachment.


Detection:

Command AntiVirus version 4.58.3 or higher with definition files dated 04/12/2001 will detect and delete the virus.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .