In Reply to: Karen Bruce : Virus posted by Si Badak ® on Friday, 30. November 2001 at 15:30 Bali Time:
From the McAfee site
A new variant of Badtrans has been discovered, referred to as Badtrans.b. AVERT has raised the Risk Assessment on this variant of W32/Badtrans@MM to High Risk for Consumers. We have received many reports from the home users that they have become infected. It is believed that failure to update recently has caused this increase in occurrence.
VirusScan and other McAfee products with DAT files 4172 and higher are protected from this variant.
W32/Badtrans@MM is a mass-mailing worm that drops a remote-access Trojan. The virus arrives via email in Microsoft Outlook and attempts to send itself by replying to unread email messages. The email may contain the text "Take a look to the attachment" in the message body and will contain an attachment that is 13,312 bytes in length. The attachment name is created from three sections.
The first part is chosen from the possibilities:
fun
Humor
docs
info
Sorry_about_yesterday
Me_nude
Card
SETUP
stuff
YOU_are_FAT!
HAMSTER
news_doc
New_Napster_Site README
images
Pics
The second part is chosen from the possibilities:
.DOC.
.MP3.
.ZIP.
and the last part from the possibilities:
pif
scr