Posted by Joe Cimoch on Tuesday, November 27, 2001 at 11:19AM :
In Reply to: Apparent Virus posted by Keith in Washington on Tuesday, November 27, 2001 at 10:56AM :
I've been getting them all weekend, but they have been getting cleaned by Norton Anti-Virus at home. The return address always has an underscore character before the name like _cimoch@dodgepowerwagon.com
Explanation from McAfee:
Dear Joe,
McAfee.com has received an increasing number of reports from home users with a new variant of Badtrans, referred to as Badtrans.b. AVERT has raised the Risk Assessment on this variant of W32/Badtrans@MM to HIGH RISK FOR CONSUMERS.
VirusScan and other McAfee products with DAT files 4172 and higher are protected from this variant.
W32/Badtrans@MM is a mass-mailing worm that drops a remote-access Trojan. The virus arrives via the Microsoft Outlook email program and attempts to send itself by replying to unread email messages.
The email may contain the text "Take a look to the attachment" in the message body and will contain an attachment that is 13,312 bytes in size. The attachment name is created in three sections, for example, card.doc.pif.
Follow Ups: