Fwd: [A_S_L] Digest Number 4686

[Guest guest]

In a message dated 11/26/01 9:05:06 AM, Atkins_Support_List

writes:

 

<< Re: Attachments turned off

 

W32.Badtrans.B@mm

Discovered on: November 24, 2001

Last Updated on: November 24, 2001 at 12:19:48 PM PST

 

 

Printer-friendly version Tell a Friend

 

W32.Badtrans.B@mm is a MAPI worm that emails itself out as one of several

different file names. This worm also drops a backdoor trojan that logs

keystrokes.

 

Type: Worm

 

Virus Definitions: November 24, 2001

 

Threat Assessment:

 

 

Wild:

Medium Damage:

Low Distribution:

High

 

 

Wild:

 

a.. Number of infections: 50 - 999

b.. Number of sites: 3 - 9

c.. Geographical distribution: Medium

d.. Threat containment: Easy

e.. Removal: Easy

Damage:

 

a.. Payload:

a.. Large scale e-mailing: Sends email from addresses found in the

default MAPI program.

b.. Compromises security settings: Installs keystroke logging Trojan.

 

Technical description:

 

 

This worm arrives as an email with one of several attachment names and a

combination of two appended extensions.

 

The list of possible file names is:

HUMOR

DOCS

S3MSONG

ME_NUDE

CARD

SEARCHURL

YOU_ARE_FAT!

NEWS_DOC

IMAGES

PICS

 

The first extension that is appended to the file name is one of the following:

..DOC

..MP3

..ZIP

 

The second extension that is appended to the file name is one of the

following:

..pif

..scr

 

The resulting file name would look something like this:

CARD.DOC.PIF

NEWS_DOC.MP3.SCR

etc.

 

When executed, this worm copies itself as kernel32.exe in the

" \windows\system " directory. It then adds the following registry value:

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Kernel32=

 

kernel32.exe.

 

Prevention methods:

1. Corporate email filtering systems should block all email that have

attachments with the extensions .scr and .pif.

2. Users should not open any emails with an attachment that matches the names

listed above. Any email that has such an attachment should be deleted.

 

 

 

Removal instructions:

 

 

 

1. Run LiveUpdate to make sure that you have the most recent virus

definitions.

2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to

scan all files. For instructions on how to do this, read the document How to

configure Norton AntiVirus to scan all files.

3. Run a full system scan.

4. Delete all files that are detected as W32.Badtrans.B (AT) mm (DOT)

5. Remove the registry value listed above.

Candace >>