F-Secure Corporation (HEX:FSC) is alerting computer users worldwide of an email worm called BadTrans.B. According to F-Secure, this worm is spreading fast through email messages and installs a spying Trojan component to steal information from infected systems.
The worm was spotted in Europe on Saturday, November 24. It is expected to keep on spreading significantly faster than the average worms, because on many systems it is capable of executing automatically when an infected email is read.
F-Secure Anti-Virus detects and stops the Badtrans virus. The detection of this variant was added early Sunday, November 25.
BadTrans spreads via e-mail by locating e-mail addresses from local html files and also by replying to e-mail messages found in the system. The messages have no content, and the subject field is typically just \"RE:\" or \"RE:\" followed by a subject of a message the worm replied. The attachment name varies, but it always has double extension such as .TXT.PIF. The worm exploits a security hole that allows it to be run automatically from infected messages on a recipient\'s computer. On systems with Internet Explorer 5.01 installed, the user never sees the attachment before it is automatically executed. Because of the US Thanksgiving holiday , many users have a higher than usual number of unread mails in their in-box, making the worm spread even more widely than would normally be the case.
Badtrans drops a spying Trojan into infected systems. This Trojan, which is detected as Trojan.PSW.Hooker, will monitor keyboard activity, log system passwords and send them out via email. Otherwise the worm won\'t try to delete files or generate massive amounts of network traffic.
\"The most important factor in this worm is the capability for executing attachment files automatically, much like the Nimda worm did,\" comments Mikko Hypponen, Manager of Anti-Virus Research at F-Secure. \"We can only hope that many people have installed suitable patches after the last big virus scares we\'ve had.\"
Technical details of the worm are posted at:
http://www.F-Secure.com/v-descs/badtrans.shtml
Ny bruger
Nybegynder
Opret
Preview
