A new variant of a mass-mailer Internet worm that installs a back door program which can allow attackers to access recipients’ computers was spreading on the Internet Monday, according to virus alerts from a number of antivirus companies.

The worm, called Badtrans.B, is a new variant of the older Badtrans virus, according to antivirus companies. The variant is executed when a user opens an infected e-mail, and does not require a user to click on an attachment, as many mass mailer worms do, according to Activis Ltd. and TruSecure Corp. virus alerts.

The worm exploits a security vulnerability in Microsoft Corp.’s Outlook and Outlook Express e-mail clients to automatically execute the attachment when the e-mail is opened, they said.

Badtrans is even more devious in that it arrives in the recipient’s inbox with a “Re:” subject line to an e-mail actually sent by the user, according to McAfee.com Corp. and TruSecure.

There is some disagreement, however, as to what happens after the worm is executed. According to TruSecure and Network Associates Inc., the parent company of McAfee.com, the worm will send itself to all e-mail addresses listed in unread messages in the victim system’s inbox. Activis, however, contends that the worm sends itself to all addresses listed in the user’s address book, much like other mass mailers.

What happens next isn’t in doubt, however, as all companies agree that the worm then installs a Trojan horse, or back door, program that will allow an attacker to gain access to the infected computer and then attempts to sends the IP (Internet Protocol) address of the infected machine to the worm’s author.

After execution, Badtrans also runs a keylogger program that can record all data entered via the keyboard, including passwords, credit card numbers and other personal information, according to Activis and McAfee.com. The data gathered by the keylogger is saved in encrypted form on the system’s hard drive, they said.

The worm will appear in e-mail boxes with either no text in the body of the message or some of the original message’s text, the companies said. The attachments included with the worm will appear to be .MP3, .DOC or .ZIP files, but are actually double extension files with .SCR or .PIF extensions, the companies said. These attachments are 13,312 bytes in length, according to Network Associates.

The companies recommended that users update their antivirus software immediately and that companies block the transfer of attached files at their e-mail gateways. Users are also urged to apply the patch to close the security hole that the worm exploits.

The patch can be found at: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-027.asp

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now