Data Highways Support Site.

Bill Williams (IT): Support Site

[home] | [profile] | [register] | [help] | [Contact Us]

[Sections] [Virus Warnings] this page	Virus Warnings	[Tell someone about this]

By	The Badtrans-B Virus
Bill Williams	Uploaded - 29 Nov 2001 19:58 BEWARE of any emails that you receive which include attachments. Unless you are expecting that attachment you should delete the eMail. With the latest virus BadtransB, as soon as you attempt to open the email or preview it, it displays an "Open Attachment Warning" box. No normal email will do this; it is a virus. Cancel the box DO NOT SAVE or OPEN the FILE. Delete the email immediately. Among other tricks, this virus looks for unread emails on infected computers and sends infected emails as a reply. This means that you might easily receive an infected eMail from a friend or colleague. The email subject will begin "Re:". In that case, the attached file name will be one of the following: PICS IMAGES README New_Napster_Site NEWS_DOC HAMSTER YOU_ARE_FAT! SEARCHURL SETUP CARD ME_NUDE Sorry_about_yesterday S3MSONG DOCS HUMOR FUN Followed by one of: .doc .mp3 .zip In turn followed by one of: .pif .scr For more information see: http://www.symantec.com/avcenter/venc/data/w32.badtrans.b@mm.html Click Link Bill Revised on 29 Nov 2001
Bill Williams	Uploaded - 3 Dec 2001 22:47 Badtrans-B Removal Instructions It will usually be best to use the instructions presented by the vendor of any anti-virus software that you currently use. The mere fact that an infected email has been sent to you does not necessarily mean that it has been activated, so you may not be infected. Use START button then Find to look for files called Kernerl32.exe or kdll.dll on your C: drive, presence of these files indicates that you have been infected. If you don't have an Anti-Virus program yet, the McAfee removal instructions appears to contain the most detailed manual instructions. Sophos: Link http://www.sophos.com/support/faqs/w32badtransb.html Norton: Link http://securityresponse.symantec.com/avcenter/venc/data/w32.badtrans.b@mm.removal.tool.html McAfee: Link http://vil.mcafee.com/dispVirus.asp?virus_k=99069&#removal_instructions F-PROT: Link http://www.f-prot.com/f-prot/virusinfo/badtrb.html Norman: Link http://www.normanuk.com/virus_info/w32_badtrans_29090_mm.shtml Innoculate: Link http://www3.ca.com/solutions/collateral.asp?CT=65&ID=1180 Bill

The Badtrans-B Virus

Bill Williams

Uploaded - 29 Nov 2001 19:58

BEWARE of any emails that you receive which include attachments. Unless you are expecting that attachment you should delete the eMail.

With the latest virus BadtransB, as soon as you attempt to open the email or preview it, it displays an "Open Attachment Warning" box. No normal email will do this; it is a virus. Cancel the box DO NOT SAVE or OPEN the FILE. Delete the email immediately.

Among other tricks, this virus looks for unread emails on infected computers and sends infected emails as a reply. This means that you might easily receive an infected eMail from a friend or colleague.

The email subject will begin "Re:". In that case, the attached file name will be one of the following:

PICS
IMAGES
README
New_Napster_Site
NEWS_DOC
HAMSTER
YOU_ARE_FAT!
SEARCHURL
SETUP
CARD
ME_NUDE
Sorry_about_yesterday
S3MSONG
DOCS
HUMOR
FUN

Followed by one of:

.doc
.mp3
.zip

In turn followed by one of:

.pif
.scr

For more information see:

http://www.symantec.com/avcenter/venc/data/w32.badtrans.b@mm.html

Click Link

Bill

Revised on 29 Nov 2001

Bill Williams

Uploaded - 3 Dec 2001 22:47

Badtrans-B Removal Instructions

It will usually be best to use the instructions presented by the vendor of any anti-virus software that you currently use.

The mere fact that an infected email has been sent to you does not necessarily mean that it has been activated, so you may not be infected. Use START button then Find to look for files called Kernerl32.exe or kdll.dll on your C: drive, presence of these files indicates that you have been infected.

If you don't have an Anti-Virus program yet, the McAfee removal instructions appears to contain the most detailed manual instructions.

Sophos: Link http://www.sophos.com/support/faqs/w32badtransb.html

Norton: Link http://securityresponse.symantec.com/avcenter/venc/data/w32.badtrans.b@mm.removal.tool.html

McAfee: Link http://vil.mcafee.com/dispVirus.asp?virus_k=99069&#removal_instructions

F-PROT: Link http://www.f-prot.com/f-prot/virusinfo/badtrb.html

Norman: Link http://www.normanuk.com/virus_info/w32_badtrans_29090_mm.shtml

Innoculate: Link http://www3.ca.com/solutions/collateral.asp?CT=65&ID=1180

Bill

Home

Page.

Implemented by Bill Williams (IT)
based on ASP Forum.

7376
adv19_66.gif