permaculture

["Graham Burnett" <gb0063551@cableinet.co.uk>]

I know this may be considered 'off topic', however my system was infected
via an email that came via a list (Permaculture UK), and my computer
subsequently tried to further spread this virus to other list members, and I

know was definately successful in infecting at least 3 others, 1 each from
the 'Vegan uk', 'Kitchen Gardens' and 'Organic L' lists, so there may well
be people out there who need this information.

Further to yesterdays virus alert, some very helpful people got in touch and
were able to assist me in understanding and dealing with what had happened,
so great thanks to them.

The virus is called 'Badtrans'. It arrives in an email that looks like a
reply to an earlier email you have sent. It quotes parts of the previous
post, then has the words "take a look to the attachment" at the bottom. As
it arrives from a 'trusted' name in your address book one might well
consider it a valid file. I did, which in retrospect was naive, even so I
ran a virus scan on the file and it came up clear.

If such an email arrives with you with an unsolicited file attached such as
those named below, DELETE IT STRAIGHT AWAY, and empty your recycle bin.

UP TO DATE virus detection software, eg, Norton, Symantec, etc, will find
and destroy Badtrans. Indeed, I was able to download the latest updates to
Innoculate IT which very quickly picked it up and deleted it from my system
(which has taught me a lesson about being complacent about being up to date
with such stuff in future). If you havn't got virus protection, you can grab
Innoculate IT free of charge from http://antivirus.ca.com/ , where you can
also get the latest updates, which you will need to deal with this little
beauty.

Sorry if I've caused you any problems or have irritated anyone by sending
this (also appologies for the 'open' mailing list yesterday, this time I've
remembered not to panic and have instead bcc'd the recipients list- oops!)

Cheers for now,

Graham Burnett

___________________________________________________

PS. Here's some info about the virus from Innoculate IT's website- don't ask
me what half of it means;

Win32.Badtrans.13312
Badtrans is a worm spreading via e-mail. The worm replies to all unread
messages and attaches itself using one of the following 16 names:

fun.pif
Humor.TXT.pif
docs.scr
s3msong.MP3.pif
Sorry_about_yesterday.DOC.pif
Me_nude.AVI.pif
Card.pif
SETUP.pif
searchURL.scr
YOU_are_FAT!.TXT.pif
hamster.ZIP.scr
news_doc.scr
New_Napster_Site.DOC.scr
README.TXT.pif
images.pif
Pics.ZIP.scr

When a user opens the attachment, the worm copies itself to the Windows
directory as:

inetd.exe

and modifies the file win.ini by including the line executing that program.

Additionally, the Badtrans worm, drops a backdoor trojan
(Win32.Badtrans.21882 Trojan). The worm creates and executes a 21882-byte
file in the Windows System directory:

kern32.exe

and modifies the registry in order to run it on the next reboot:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\kernel32=kern32.exe

The Trojan, which is in fact a backdoor server also uses its own library:
hksdll.dll (a 5632-byte file created in the same directory).

Detection for this worm/trojan ( both Win32.Badtrans.13312 worm and
Win32.Badtrans.21882 Trojan) has been added to the following virus
engine/virus signature combination. Install this update or later to ensure
protection:

CA Anti-Virus Product Engine/Signature
InoculateIT 4.x 22.65
InoculateIT 6.0 23.40.65
InoculateIT Personal Edition 5.2/1185
VET  10.3/1185