Someone sent her a virus in an e-mail and it seems to have automatically forwarded it to everyone in her e-mail address book. It is a blank e-mail with an attachment. If you have received it and your antivirus hasn't spotted it and quarantined it, then you need to delete it yourself. DON'T OPEN THE ATTACHMENT.

Hi Fljotsdale!

I received the e-mail from tracey and thankfully Norton caught it and quarantined it as it came. i was wondering if she knew about it. Thanx for the heads-up! Is her machine okay?

I hope Tracey's machine is ok!

It's one thing to have to reformat because you want to clean your machine up, but another one entirely to do it because some jerk thinks it's fun to screw with people.

Virus spreaders are the scum of the earth!

My buddy got a "funny" virus and had to reformat his hard drive about a year ago. Every time he would go into a MSN chat room he'd lose control of his computer, and it would start spewing forth vile language in the chat room. People would say, "why are you saying that stuff". The only way he could stop it was to reboot. It only affected him while chatting, but once infected, the virus could not be isolated, so the only choice was to reformat. I hope her's isn't that bad!

Thanks for the "heads up"!

Got it, killed it, and emailed her back telling her to update her virus definitions. I update mine every couple of days. SirCam hit me REALLY hard - I had to get rid of this virus from my registry manually and it took about an hour - and no way that's ever happening again. ;)

The virus was called W32.Badtrans.B@mm btw.

I don't know how much her machine is affected - I only found out about it from Silver Cheetah about an hour ago, and tracey has gone to bed. Silver Cheetah had a call from a mutual friend of hers and traceys telling her about it, so she called me. I hadn't checked my mail for some days, but I did after the phonecall and Norton informed me and quarantined it and I deleted it, so should be ok.
Tracey doesn't have a very good antivirus so she may be in trouble. I don't think she knows about it yet....
I'm gonna buy her the Norton 2002 programme pronto!

<blockquote>quote:</font><hr>Originally posted by Ronn_Bman:
Virus spreaders are the scum of the earth!

<hr></blockquote>

Yes, torture is too good for them, unless provided by a Torture Master of at least Rank 9.

<blockquote>quote:</font><hr>Originally posted by Naked Wild Man:


Yes, torture is too good for them, unless provided by a Torture Master of at least Rank 9.<hr></blockquote>


At the very least Rank 9! [img]graemlins/thumbsup.gif[/img]

Silver Cheetah found out that her McAffee sub had run out, so the darn thing latched onto her hard drive. She has now downloaded the Norton 2002, phoned a friend to find out how to clean up her drive, and fixed it.
I now have the job of cleaning up traceys machine! The Norton 2002 that I ordered for her should arrive tomorrow, so wish me luck fixing her machine for her! She has switched off her modem for the time being, just to be on the safe side, so you won't see her here for a couple of days.

<blockquote>quote:</font><hr>Originally posted by Fljotsdale:
Silver Cheetah found out that her McAffee sub had run out, so the darn thing latched onto her hard drive. She has now downloaded the Norton 2002, phoned a friend to find out how to clean up her drive, and fixed it.
I now have the job of cleaning up traceys machine! The Norton 2002 that I ordered for her should arrive tomorrow, so wish me luck fixing her machine for her! She has switched off her modem for the time being, just to be on the safe side, so you won't see her here for a couple of days.<hr></blockquote>

What I am REALLY confused about is how come the virus came to me with the subject header re: re: The Illuminati.

Of course I opened it, as it was from Tanya, and with a IW related subject header. I never even thought it might be a virus.

Anyone got any thoughts on this?

The virus will use e-mails that are still in the inbox to send itself to everyone. I had got a couple from someone else from my board that had re re Welcome to Myth Drannor and then I had one the just had re in the subject line.

Install Unix [img]graemlins/hehe.gif[/img] [img]smile.gif[/img]
I open my mail at Solaris first, and never ever use Outlook or other Miscrosoft mailing application under Windows.
(and if you have - install also last patches from Microsoft)

Zbyszek

People are getting more and more devious each day. Here's a report on the BadTrans virus.

<font color="silver">
Revamped virus hits Australia
While major anti-virus software vendors report the global threat as limited, Morgan told ZDNet Australia that the virus has become particularly prevalent in Australia since it was first detected on Saturday. A revamped version of the equally awkwardly named W32badtrans.13312@mn, the virus is designed to install a backdoor Trojan which picks up passwords by reading keystrokes.

Dinesh Rajalingam, technical director at the Melbourne-based Virus Defence Bureau points out that while the W32badtrans@mn is not as immediately destructive as some of the more virulent viruses, it is nonetheless capable of compromising the security of infected machines.


“It is not going to wipe your hard drive, but it will certainly pick up on all your passwords,” said Rajalingam. “Those most at risk are people with signature based virus protection, because they are unlikely to recognise the virus unless it has already been updated.”

Rajalingam said computer owners and users are better advised to implement behaviour-based anti-virus software, as it would register the unusual behaviour of the virus and neutralise it before it had time to compromise the system.
In a similar vein, Symantec is advising companies to revise e-mail filtering systems to make sure they block attachments with the extensions .scr and .pif.

David Banes, regional manager for Symantec's security response team, said the W32badtrans@mn was particularly hard to detect without software as it was constantly changing its three letter file type.

“This virus appears under a number of names both in terms of the attachment and the file type,” Banes said. “End users should update their anti-virus software and keep an eye out for any unusual e-mails.”

How it works

Badtrans.B arrives as e-mail. It replies to old e-mail, so the subject line is one that someone has already sent you, so you might be inclined to open it. The e-mail message itself is empty. Badtrans.B includes an attached file whose name is created from the following list:

FUN
HUMOR
DOCS
S3MSONG
Sorry_about_yesterday
ME_NUDE
CARD
SETUP
SEARCHURL
YOU_ARE_FAT!
HAMSTER NEWS_DOC
New_Napster_Site
README
IMAGES
PICS

The attachment is a DOC, MP3, or ZIP file, with a second extension of either SCR or PIF. For example, an attached file might be named Readme.doc.scr.

Users need not open the attached file to infect their machines. Badtrans uses a known vulnerability in Internet Explorer that automatically opens attachments. In this case, the attached file contains Troj.PWS-AV, a password-stealing Trojan horse. Troj.PWS-AV records all keystrokes and the application name where a keystroke was typed, storing it in encrypted form. The Trojan then connects to a SMTP server to send the log file to a Hotmail e-mail address.

Prevention

Badtrans.B uses a known vulnerability in Outlook Express that is included in Internet Explorer 5.01 and 5.5. Microsoft has released a patch. Users who have not loaded the patch are encouraged to do so or to upgrade to Internet Explorer 6.

Removal

Most antivirus software companies have updated their signature files to include this worm. For more information on removing this worm from your system, see Central Command, F-Secure, Kaspersky,McAfee, Sophos, Symantec, or Trend Micro.

</font>

Update your virus definitions regularly and scan at least once a week. It's the best investment you'll make.