Nederlands Forum over Oude Radio“s

Onafhankelijk medium voor liefhebbers en verzamelaars van oude radio“s en gerelateerde zaken (zoals oude TV“s, versterkers, meetapparatuur). Hier kunt u discussiėren en chatten over uw hobby. Voorbeelden zijn: identificatie of datering van oude toestellen, vragen over documentatie, hulp bij reparaties en restauraties. De voertaal op dit forum is Nederlands, maar bijdragen in andere talen zijn ook welkom.

Tips hoe je van dit virus afkomt

Geschreven door Michiel van der Smeede om 27. Nov 2001 10:30:55:

In reactie op: VIRUS!!!! OPEN GEEN MAIL VAN PAUL WELTHER geschreven door RAMON POOL om 27. Nov 2001 09:06:53:

Ik kreeg ook dit virus binnen van Ben Dijkman.

Hierbij tips hoe je ervan afkomt: (zie http://vil.nai.com/vil/virusSummary.asp?virus_k=99069 )

Description Menu
Virus Characteristics
Symptoms
Method Of Infection
Removal Instructions
Variants / Aliases
Rate this page
Print This Page


Virus Characteristics
UPDATE November 25, 2001 20:30 PST
AVERT has raised the Risk Assessment on the Badtrans.b variant to Medium On Watch for corporate users and High for home users. We have received many reports that the virus is being seen and stopped at corporate gateways and mailservers. However, we continue to get reports from the home user segment that they have become infected. This is due to the fact that home users tend to update their DAT files less frequently and often do not have VirusScan configured to scan compressed files which is required for detection.
At the bottom of this page is an extra.dat file for those who have not updated and would like to make a quick update without downloading the latest DATs. AVERT does always recommend updating to the latest DATs. They are located here .

As noted below, the virus is detected as W32/Badtrans@MM as the detection technology, which identified the virus first, uses this naming convention for both variants of the Badtrans virus.

This new variant of Badtrans drops a password stealing trojan which is detected as a variant of PWS-AV since the 4172 DATs.

UPDATE November 24, 2001 15:30 PST
A new variant of Badtrans has been discovered. This is considered to be variant .b by some companies. VirusScan and other McAfee products with DAT files 4168 are protected from this variant without any updating from that DAT. The variant will be detected as W32/Badtrans@MM when scanning compressed files.

This variant is a Medium risk as is the first variant. Your risk of infection is higher if you do not have the 4168 DAT files or above. See the .b section below for more details on this variant.

Badtrans.a details:
This mass mailing worm attempts to send itself using Microsoft Outlook by replying to unread email messages. It also drops a remote access trojan (detected as Backdoor-NK.svr with the 4134 DATs; detected heuristically as New Backdoor prior to the 4134 DAT release).

When run, the worm displays a message box entitled, "Install error" which reads, "File data corrupt: probably due to a bad data transmission or bad disk access." A copy is saved into the WINDOWS directory as INETD.EXE and an entry is entered into the WIN.INI file to run INETD.EXE at startup. KERN32.EXE (a backdoor trojan), and HKSDLL.DLL (a keylogger DLL detected as PWS-AV (was DUNpws.av) are written to the WINDOWS SYSTEM directory, and a registry entry is created to load the trojan upon system startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunOnce\kernel32=kern32.exe

Note: Under WinNT/2K, an additional registry key value is entered instead of a WIN.INI entry:

HKEY_USERS\Software\Microsoft\Windows NT\
CurrentVersion\Windows\RUN=%WinDir%\INETD.EXE

Once running, the trojan attempts to mail the victim's IP Address to the author. Once this information is obtained, the author can connect to the infected system via the Internet and steal personal information such as usernames, and passwords. In addition, the trojan also contains a keylogger program which is capable of capturing other vital information such as credit card and bank account numbers and passwords.

The next time Windows is loaded, the worm attempts to email itself by replying to unread messages in Microsoft Outlook folders. The worm will be attached to these messages using one of the following filenames (note that some of these filenames are also associated with other threats, such as W95/MTX.gen@M):

Card.pif
docs.scr
fun.pif
hamster.ZIP.scr
Humor.TXT.pif
images.pif
New_Napster_Site.DOC.scr
news_doc.scr
Me_nude.AVI.pif
Pics.ZIP.scr
README.TXT.pif
s3msong.MP3.pif
searchURL.scr
SETUP.pif
Sorry_about_yesterday.DOC.pif
YOU_are_FAT!.TXT.pif

The message body may contain the text:
Take a look to the attachment.

AVERT first received an intended version of this worm (10,623 bytes) on April 11 from a company in New Zealand.
Badtrans.b details:
When run, this variant copies itself to the WINDOWS SYSTEM directory as KERNEL32.EXE and creates a registry run key to load itself at startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunOnce\kernel32=kernel32.exe

This variant replies to incoming email messages and sends itself to email addresses found in "*.asp" and "*.ht*" files. The sender address used by the virus when emailing itself to others may be chosen from the following list:
" Anna"
"JUDY"
"Rita Tulliani"
"Tina"
"Kelly Andersen"
"Andy"
"Linda"
"Mon S"
"Joanna"
"JESSICA BENAVIDES"
" Administrator"
" Admin"
"Support"
"Monika Prado"
"Mary L. Adams"

Additionally, the virus prepends the return address used with an "_" (underscore). Thus replying to an infected message will fail to reach the intended recipient.

The message subject is typically: "Re:"

The message attachment name is created from three sections. The first part is chosen from the possibilities:

fun
Humor
docs
info
Sorry_about_yesterday
Me_nude
Card
SETUP
stuff
YOU_are_FAT!
HAMSTER
news_doc
New_Napster_Site
README
images
Pics


The second part is chosen from the possibilities:
.DOC.
.MP3.
.ZIP.


and the last part from the possibilities:
pif
scr

This new variant uses the iframe exploit and incorrect MIME header to run automatically on unpatched systems. See Microsoft Security Bulletin (MS01-020) for more information and a patch.
It also drops a password-stealing trojan (KDLL.DLL), detected as PWS-AV variant with the 4172 DATs or greater.


Top of Page

Symptoms
- Presence of the file %WinDir%\INETD.EXE
- Presence of the file %SysDir%\KERN32.EXE
- Presence of the file %SysDir%\KERNEL32.EXE
- Email correspondence noting that you've sent them an attachment when you did not.

Top of Page

Method Of Infection
This worm utilizes MAPI messaging to mail itself to regular email correspondence. It will arrive as an attachment that is 13,312 bytes in length and uses one of the following names (note that some of these filenames are also associated with other threats, such as W95/MTX.gen@M):
Card.pif
docs.scr
fun.pif
hamster.ZIP.scr
Humor.TXT.pif
images.pif
New_Napster_Site.DOC.scr
news_doc.scr
Me_nude.AVI.pif
Pics.ZIP.scr
README.TXT.pif
s3msong.MP3.pif
searchURL.scr
SETUP.pif
Sorry_about_yesterday.DOC.pif
YOU_are_FAT!.TXT.pif

The message body may contain the text:
Take a look to the attachment.


Top of Page

Removal Instructions
All Windows Users:
Use current engine and DAT files for detection and removal. GUI products must be configured to scan COMPRESSED FILES.

Install the Microsoft Security Bulletin (MS01-020) patch
EXTRA.DAT files:
The following Extra.DAT and Super Extra.AT files are also available:
EXTRA.DAT
SUPER EXTRA.DAT

Manual Removal Instructions


Restart the computer in MS-DOS mode
Delete the files mentioned
Restart Windows
Delete the registry keys as mentioned
Additional Windows ME Info:
NOTE: Windows ME utilizes a backup utility that backs up selected files automatically to the C:\_Restore folder. This means that an infected file could be stored there as a backup file, and VirusScan will be unable to delete these files. These instructions explain how to remove the infected files from the C:\_Restore folder.

Disabling the Restore Utility

1. Right click the My Computer icon on the Desktop.
2. Click on the Performance Tab.
3. Click on the File System button.
4. Click on the Troubleshooting Tab.
5. Put a check mark next to "Disable System Restore".
6. Click the Apply button.
7. Click the Close button.
8. Click the Close button again.
9. You will be prompted to restart the computer. Click Yes.
NOTE: The Restore Utility will now be disabled.
10. Restart the computer in Safe Mode.
11. Run a scan with VirusScan to delete all infected files, or browse the the file's located in the C:\_Restore folder and remove the file's.
12. After removing the desired files, restart the computer normally.
NOTE: To re-enable the Restore Utility, follow steps 1-9 and on step 5 remove the check mark next to "Disable System Restore". The infected file's are removed and the System Restore is once again active.



Top of Page

Variants
Name Type Sub Type Differences


Top of Page

Aliases
Name
Backdoor-NK.svr
BadTrans (F-Secure)
I-Worm.Badtrans (AVP)
TROJ_BADTRANS.A (Trend)
W32.Badtrans.13312@mm (NAV)







Reacties / Answers:


Terug naar Nederlands Forum over Oude Radio“s