BadTrans.B worm is spreading rapidly...

Computer users turned on their PCs this morning to find their In-boxes flooded with copies of the latest mass mailing virus.

BadTrans.B is spreading rapidly after infecting a large number of home users in the UK over the weekend. BTOpenworld shut off an email system today, but not before infecting many customers with the virus.

MessageLabs, a managed services firm which scans for and blocks viruses in email for clients, has blocked 5,164 copies of the virus this morning. Its figures show btinternet.com, ntlworld.com and freeserve.co.uk as the most common sources of the virus.

BadTrans.B is a variant of a virus which first appeared in April. It usually arrives as an email with either the subject line Re: (name of file attachment) or Re: (the subject line of a previous message thread). The email contains a double attachment and a name made up of a series of elements which "alternate like a fruit machine", according to Mark Sumner, CTO of MessageLabs.

BadTrans.B uses a known exploit, related to the processing of certain unusual MIME types, in certain versions of Outlook Express 5 so as to launch an attachment automatically. The trick, which was also used by the authors of the Nimda worm, means simply previewing an infected email is enough to get infected. Users who double click on an infected attachment also risk infection.

BadTrans.B uses MAPI to spread and gets target addresses from unread messages in a user's email client. The worm also drops a file named kdll.dll, which is the password stealing Trojan PWS-AV , on an infected user's PC.

Users should update their antivirus protection to guard against the virus. In addition, corporate users should consider blocking emails with .pif or .scr attachments at the email gateway, a step that would block BadTrans.B before it reaches user's desktops.

Thanks for helping get the word out....

People need to be aware of these things as soon as possible.

For those of you wanting more information, try this link...

http://www.symantec.com/avcenter/ven...rans.b@mm.html

Thanks again.

IchNiSan

Yesterday, my company briefly experianced the ILOVEYOU.txt.vbs file floating through our mail system. Those of us in IT knew better then opening the attachment but a few people where tricked and the mail system was taken offline for a couple hours.

I still wonder to this day why microsoft by default hides file extensions for "known types".

Cheers,

D

This virus/worm (which introduces a password stealing trojan as its payload) is not that new. For example, McAfee discovered the version 'a' varient on April 11th.
It is also interesting to note that the heuristic scanning part of Mcafees AV scanner flags this as a potentional virus, even when running an out of date DAT file. Which I guess proves heuristic scanning can work.
It shouldn't affect any work related systems (if your firewall/AV software isn't blocking this sort of thing, then you should get a new admin guy :rolleyes: ). Instead, it has tended to infect home systems which do not have up to date AV software active.