To: K-list
Recieved: 2001/11/26 19:10
Subject: [K-list] THe trans virus
From: Final Element J A Livengood
On 2001/11/26 19:10, Final Element J A Livengood posted thus to the K-list: It is me_nude .scr from aly AKA Molly ATnospam aol.com. I am going to contact them tomorrow.
but in the meantime, it is a new virus, please read this CENTRALCOMMAND.COM Newsletter
Without us, there's no defense. Virus Warning: I-Worm.Badtrans.B
Central Command is warning its customers of a new Internet worm
spreading throughout the world. At this time Central Command is
issuing a "Medium" risk to this new worm. Details:
Name: I-Worm.Badtrans.B
Aliases: Win32.Badtrans-BATnospammm, W32/BadtransATnospammm
ITW: Yes
Risk: Medium Description:
I-Worm.Badtrans.B is a new variation of the Internet worm, I-
Worm.Badtrans.A, a virus that spread via e-mail (a copy of the worm
was sent as a reply message to all unread emails in the users Inbox
folder).
The worm arrives in the following e-mail format:
Attachment line: A randomly selected messaged built from the
following list and combinations:
docs, info, Me_nude,
Card, Humor, Sorry_about_yesterday
YOU_are_FAT!, stuff, news_doc
README, images, HAMSTER
The first extension selected will be either: *.doc or *.zip or
*.MP3
Second extension selected will be either: *.scr or *.pif
These are a couple examples of possible choosen subject lines:
Me_nude.zip.scr
README.MP3.pif
stuff.zip.pif
Body: (Blank)
If executed, the worm copies itself in the \windows\%system%
directory under the filename "kernel32.exe". So that it gets run
each time a user restart their computer the following registry key
gets added:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnc
e\Kernel32 ="kernel32.exe"
Removal:
Step 1.) Run a deep scan of your PC and delete any files identified
as being infected with I-Worm.Badtrans.B
Step 2.) Delete the created registry key listed above Central Command, Inc. respects your online privacy. You at anytime
can easily remove your e-mail address from the Central Command mailing
list by entering in your e-mail address at the following web page:
http://www.centralcommand.com/unsubscribe.html
http://www.kundalini-gateway.org
Feel free to submit any questions you might have about what you read here to the Kundalini
mailing list moderators, and/or the author (if given). Specify if you would like your message forwarded to the list. Please subscribe to the K-list so you can read the responses.
All email addresses on this site have been spam proofed by the addition of ATnospam in place of the symbol.
All posts publicly archived with the permission of the people involved. Reproduction for anything other than personal use is prohibited by international copyright law. ©
This precious archive of experiential wisdom is made available thanks to sponsorship from Fire-Serpent.org.
URL: http://www.kundalini-gateway.org/klist/k2001b/k200105594.html
|