With the upgrade by SYMANTEC of the BADTRANS virus to category FOUR, and given the fact that McAfee does not yet detect said virus , users should be DOUBLY AWARE of this rapidly spreading virus..... Today i received several copies of this virus already... from GR researchers and fellow list-subscribers! < My ZoneAlarm has isolated same > but my < UPDATED!!!> McAfee AV has not [yet] identified it Please note the information below.... And be CAREFUL with attachments! >From SYMANTEC! http://securityresponse.symantec.com/avcenter/venc/data/[email protected] ml [email protected] Discovered on: November 24, 2001 Last Updated on: November 26, 2001 at 12:46:58 PM PST Due to the increased rate of submissions, we have updated the threat level of this worm from level 3 to level 4. [email protected] is a MAPI worm that emails itself out as one of several different file names. This worm also creates a DLL in \Windows\System directory as Kdll.dll. It uses functions from this DLL to log keystrokes. Type: Worm >From McAfee! http://www.mcafee-at-home.com/naicommon/aboutnai/press/releases/pr_template. asp?PR=/PressMedia/11262001.asp&Sel=1130 Symptoms W32/[email protected], also known as Badtrans or Badtrans.b, is a mass-mailing Internet worm that attempts to send itself using Microsoft Outlook by replying to unread e-mail messages. When executed, Badtrans also drops a remote access Trojan, or RAT, into the users Windows directory, which attempts to mail the victim's IP address to the author. Subject: (Variable) Body Text: (May contain). Take a look to the attachment Attachment: (Variable). The worm will arrive as an attachment that is 13,312 bytes in length and takes on the form of one of the following examples: S3MSONG.DOC.scr Pics.DOC.scr HUMOR.MP3.scr Sorry_about_yesterday.MP3.pif README.MP3.scr ME_NUDE.MP3.scr fun.MP3.pif NEWS_DOC.DOC.scr docs.DOC.pif images.DOC.pif HAMSTER.DOC.pif SEARCHURL.MP3.pif Date: Tue, 13 Nov 2001 20:07:39 -0400 Reply-To: ÷j. <[email protected]> Sender: <[email protected]> From: ÷j. <[email protected]> Subject: MORE ON [VIRUS] ATTACHMENTS, with apologies for the off-topic message; was: To provide a link to another Content-Type: text/plain; charset="iso-8859-1" It is certainly true that attachments with a name-extention of EXE are bad news... however it's a big mistake to only be concerned about them. <In fact the very nasty virus MAGISTR has never arrived as an .EXE attachment!; the makers of a virus realize that most people know about EXE files by now... > In my "virus collection" i have files with names like: CLEAN.BAT NEEDS.BAT CHAIR.BAT CARD.PIF ENTRIES.PIF OEMRNCE.EXE WOULD.EXE SEXY VIRGIN.SCR New_Napster_Site.DOC.scr Homepage.HTML.vbs and many others < e.g. .LNK, .COM, etc. .....> * In addition imbedded macros in attachments that are <for> EXEL; POWERPOINT or WORD can be lethal** Soo, it's no good to just be leary of ".EXE" attachments!!! ANY attachment should be "isolated; inspected and cleared" before opening same!