New version of 'Badtrans' worm spreading fast

November 27, 2001

A new version of an Internet worm called Badtrans is rapidly spreading in the wild.

W32/BadTrans.B-mm spreads itself via e-mail and have already infected thousands of systems across Europe and in the United States on Monday.

After infection the malicious agent installs a program that watches what the victim types and attempts to steal private information from victim's computer.

The worm exploits a flaw in Internet Explorer, which is used by Microsoft's e-mail clients to display messages in HTML format. The hole, which was patched by Microsoft last March, causes Microsoft's e-mail readers automatically to run attachments to specially crafted e-mails.

Once the worm infects a system, it replies to any unread e-mail in the victim's Microsoft Outlook Inbox folder.

BadTrans.A, the predecessor of W32/BadTrans.B-mm, was first discovered in January, but this new variant was unleashed in compressed form, meaning it avoids detection by older antivirus software.

To prevent the infection the users are recommended to update their antivirus software.

It is also recommended to fix the IE hole (if you have not done it yet) by installing the patch from Microsoft Web-site: click here to download