Note: The Rootsweb Mailing Lists will be shut down on April 6, 2023. (More info)
RootsWeb.com Mailing Lists
Total: 1/1
    1. [NJWARREN] Norton removed BadTran virus
    2. Catherine R. Buck
    3. Everybody: I customarily read the Subject line in emails, to see if it's something I'm interested in. If it is, I open it. If not, I delete it. Unread. This will not protect you from the virus. I got mine on Sunday. While I was at church. How ironic. I received from someone unknown a virus which has various names. All the following tech talk is from the Symantec.com security link. <W32/Badtrans-A> < W32/[email protected]> <BadTrans> <IWorm_Badtrans> <IWorm.Badtrans> <TROJ_BADTRANS.A> It is a MAPI worm that replies to all *unread* messages in your email message folders and drops a backdoor Trojan. When the worm is executed, it drops the backdoor Trojan Hkk32.exe into the Windows folder and executes it. It then copies itself into the \Windows folder as inetd.exe, adds a run= line to the Wini.ini file, and displays the following message: [in a drop down window] [[[ Install error File data corrupt: probably due to bad data transmission or bad disk access ]]] If that shows up, you have the virus. Among other bad things, it can leave a "computer thing" in there to enable the originator to ""see"" financial information on your computer. If you have DSL or always on service, the perps have 24 hour access to your hard drive. In my case, it took all the addresses in my book, attached my name as if the messages were coming from me, put an attachment symbol on, and sent them out from my Outbox. And maybe it did the financial thing, too, for all I know. When I was told by a listowner that the virus was coming from me, I blocked the Outbox from sending anything out, and got hold of Norton which walked me through the cure. I didn't keep my Norton system updated - seldom took the time. It would have saved me from three days of frustration, and messages like the one about "the vicious souls who are sending out this message, and the FBI is investigating". By the time the FBI finds out what is happening, the virus has probably mutated gazillion times, been around the world in all the mutations, and the perps are laughing all the way to the bank. The Norton fellow also told me that there is a worm virus named <kak.html> to which Outlook Express is particularly vulnerable. there is a patch for it on Microsoft Web Help, and I intend to install it. Norton fellow also told me to disable the Preview Pane (window) so that I can see only one message at a time, because when you see a message in there, even if you haven't double-clicked to open to a bigger window, and did send it to delete, the message is still "opened". There are instructions for disabling Preview window also on Microsoft Web Help. Ruth in GA

    06/12/2001 11:41:39