Win32/Badtrans.B Worm

 Information about the Win32/Badtrans.B worm:

Badtrans.B is a mass mailing email worm. This a variant of Badtrans.A worm. This worm will infect Windows systems. Badtrans.B spreads through MS-Outlook or Outlook Express.

Click here to download the FREE utility (CleanBT.EXE) to detect and remove the Win32/Badtrans.B worm from your computer.

The email generated by the worm could have the subject as a response to an earlier mail sent from the system, with the Re: prefix. Sometimes, it is also know to have just Re: in the subject. The infected mail carries an attachment, which is in a compressed format with any one of the following names:

Sorry_about_yesterday.DOC.pif
news_doc.scr
fun.pif
Pics.ZIP.scr
images.pif
README.TXT.pif
Humor.TXT.pif
New_Napster_Site.DOC.scr
hamster.ZIP.scr
s3msong.MP3.pif
YOU_are_FAT!.TXT.pif
searchURL.scr
SETUP.pif
Card.pif
Me_nude.AVI.pif
docs.scr

When the infected attachment is executed, it checks if the process KERNEL32.EXE, is running. If the Worm finds this process running, it terminates the process and copies itself to the WINDOWS\SYSTEM directory as KERNEL32.EXE. It then goes on to collect RAS information of the system and stores it as a file, CP_25389.NLS, in an encrypted format. It copies a trojan file called KDLL.DLL, which collects passwords and details of the programs running.

A registry key is created;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\kernel32

Email addresses from .HTM, .HTML and .ASP files are collected as well and Badtrans emails itself to those addresses.

 Other names of Win32/Badtrans.B worm:

The worm is also known as W32.Badtrans.B, IWorm_Badtrans, TROJ_BADTRANS.B.

 Removing Win32/Badtrans.B worm from your computer:

You can remove this worm from your computer by using Protector Plus antivirus software.