PCA Forums

I was sent 3 yesterday and so far today I've received 6. Last few today was that typical:

Hi, how are you?

I send you this file in order to have your advice

The others had a script attachement called "humor.mp3.scr"

Fortunately my virus scanner identified and stopped them all. If you have a virus scanner then I suggest to update it asap. these are all only sent via outlook or outlook express. Why ms can't stop this crap is beyond me.


More info on this new virus here and REMOVAL instructions:
http://securityresponse.symantec.com/av ... .b@mm.html

Home users should not open any email that has an attachment in which the second extension is .pif or .scr. Any email that has such an attachment should be deleted.


highlights:

Due to the increased rate of submissions, Symantec Security Response has upgraded the threat level of this worm from level 3 to level 4 as of November 26, 2001.

W32.Badtrans.B@mm is a MAPI worm that emails itself out using different file names. It also creates the file \Windows\System\Kdll.dll. It uses functions from this file to log keystrokes.



This worm arrives as an email with one of several attachment names and a combination of two appended extensions. It contains a set of bits that control its behavior:

001 Log every window text
002 Encrypt keylog
004 Send log file to one of its addresses
008 Send cached passwords
010 Shut down at specified time
020 Use copyname as registry name (else kernel32)
040 Use kernel32.exe as copyname
080 Use current filename as copypath (skips 100 check)
100 Copy to %system% (else copy to %windows%)

When it is first executed, it copies itself to %System% or %Windows% as Kernel32.exe, based on the control bits. Then it registers itself as a service process (Windows 9x/Me only). It creates the key log file \%System%\Cp_25389.nls and drops %System%\Kdll.dll which contains the key logging code.

NOTE: %Windows% and %System% are variables. The worm locates the \Windows folder (by default this is C:\Windows or C:\Winnt) or the \System folder (by default this is C:\Windows\System or C:\Winnt\System32) and copies itself to that location.





The attachment name will be one of the following:

Pics
images
README
New_Napster_Site
news_doc
HAMSTER
YOU_are_FAT!
stuff
SETUP
Card
Me_nude
Sorry_about_yesterday
info
docs
Humor
fun

In all cases, MAPI will also be used to find unread mail to which the worm will reply. The subject will be "Re: ". In that case, the attachment name will be one of the following:

PICS
IMAGES
README
New_Napster_Site
NEWS_DOC
HAMSTER
YOU_ARE_FAT!
SEARCHURL
SETUP
CARD
ME_NUDE
Sorry_about_yesterday
S3MSONG
DOCS
HUMOR
FUN

In all cases, the worm will append two extensions. The first will be one of the following:

.doc
.mp3
.zip

The second extension that is appended to the file name is one of the following:

.pif
.scr

The resulting file name would look similar to CARD.Doc.pif or NEWS_DOC.mp3.scr.

Thanks for the info, got a lot of those lately...

Guess I'm lucky afterall, I use Netscape for mail (wife likes it), and no-one emails me anymore but the spammers.

Thanks for the info, I'm going to the A.V. downloads.....ciao.