Antivirus Vendors Warn of Badtrans Worm
Patch available for Outlook flaw that allows worm to propagate.
Sam Costello, IDG News Service
A new variant of a mass-mailer Internet worm that installs a backdoor program that can allow attackers to access recipients' PCs is spreading on the Internet, according to virus alerts from a number of antivirus companies.
The worm, called Badtrans.B, is a new variant of the older Badtrans virus, according to antivirus companies. The variant is executed when a user opens an infected e-mail, and does not require a user to click on an attachment, as many mass mailer worms do, according to Activis and TruSecure virus alerts. The worm exploits a security vulnerability in Microsoft Outlook and Outlook Express e-mail clients to automatically execute the attachment when the e-mail is opened, they said.
The companies recommended that users update their antivirus software immediately and that companies block the transfer of attached files at their e-mail gateways. Users are also urged to apply an available patch to close the security hole that the worm exploits.
Devious Deception
The latest Badtrans virus is even more devious than its predecessor, in that it arrives in the recipient's in-box with a "Re:" subject line to an e-mail actually sent by the user, according to McAfee.com and TruSecure.
There is some disagreement, however, as to what happens after the worm is executed. According to TruSecure and Network Associates, the parent company of McAfee.com, the worm will send itself to all e-mail addresses listed in unread messages in the victim system's in-box. Activis, however, contends that the worm sends itself to all addresses listed in the user's address book, much like other mass mailers.
What happens next isn't in doubt, however, as all companies agree that the worm then installs a Trojan horse, or backdoor, program that will allow an attacker to gain access to the infected computer and then attempts to sends the IP (Internet Protocol) address of the infected machine to the worm's author.
Identifying Marks
After execution, Badtrans also runs a keylogger program that can record all data entered via the keyboard, including passwords, credit card numbers and other personal information, according to Activis and McAfee.com. The data gathered by the keylogger is saved in encrypted form on the system's hard drive, they said.
The worm will appear in e-mail boxes with either no text in the body of the message or some of the original message's text, the companies said. The attachments included with the worm will appear to be .MP3, .DOC or .ZIP files, but are actually double extension files with .SCR or .PIF extensions, the companies said. These attachments are 13,312 bytes in length, according to Network Associates.
Perfect Print Solutions
Full Windows 7 coverage
- Great year-end deals

for small business! -
Get 24/7 live remote AT&T Tech Support 360* service along with select Lenovo* PCs (with Intel® Core™ 2 Duo processors) and save up to 200!
-
HP EliteBook* 6930p Notebook with Intel® vPro™ technology and a free HP Basic Docking Station - $641 instant savings!
- *Other names and brands may be claimed as the property of others. ©2009 Intel Corporation. Intel, the Intel logo, vPro and Core trademarks of Intel Corporation in the United States and other countries. All rights reserved.
People who read this also read:
Best Prices on Security Software
Norton Internet Security 2010 - 3 UsersPrice: $26.30
Norton 360 Version 3.0 - 3 LicensesPrice: $39.99
Norton Internet Security 2010 - 3 UserPrice: $26.30
Internet Security 2010Price: $31.87
Norton 360Price: $25.00
Total Protection 2010 - 3 UserPrice: $26.47
- Perfect Printing Solutions Find just the right All-in-One Printer for you from HP. Visit the HP Resource Center.
- Acer Laptop Center Forget the Mouse...check out the next generation multi-gesture touch screen technology from Acer.
- Dell Shopping Center Check out great deals from Dell!
Cameras
Camcorders
Cell Phones
Components
Desktops
HDTV
Home Theater
GPS
Laptops
Monitors
MP3 Players
Networking &
Printers
Storage







