Virus warning!!!!!!!!

[Archive]

Posted By: Lee Behrens

If any of you received an email from me with an attachment (bowl@rea-alp.com) DO NOT open it, it has a virus. I think I got it from an ebayer. The dumb thing send it out to everyone you had contact in the past with, and I know I have contacted some of you.

The attachment had 2 end a notepad, and a picture or something. I'm kind of illiterate in these matters.

Beware of any emails from ebayers with attachments, I am pretty sure I got it from one of them. I am pretty sure some of my contacts were sent it.

Sorry if it causes any problems, I am unsure of what it does. i will sent more info when I find out.

Lee

[Archive]

Posted By: Tom

but not from you. From another ebayer.......

[Archive]

Posted By: Lee Behrens

Here are some of the bad file locations:

WORM BADTRANS.B

WINDOWS/SYSTEM/KERNEL
WINDOWS/SYSTEM/kdll.dll
WINDOWS/Recycled/Dcl.scr

JS EXCEPTION.GEN
2 files unsure what is after temp internet

WINDOWS/TemporaryInternet

I have not yet figured out how to get rid of them.

This really bites.

[Archive]

Posted By: runscott

Symantec is the best place to check for virus fixes - they have a detailed description and "removal instructions" for this one at: http://securityresponse.symantec.com/avcenter/venc/data/w32.badtrans.b@mm.html

[Archive]

Posted By: runscott

Here's the important thing to look for in attachments. Make sure your browser is configured to prompt before opening attachments. When prompted, look for the following - if found, cancel, then delete the e-mail and immediately empty your 'deleted' folder or 'recycle bin'.

In all cases, the worm will append two extensions. The first will be one of the following:

.doc
.mp3
.zip

The second extension that is appended to the file name is one of the following:

.pif
.scr

[Archive]

Posted By: MW

Runscott is correct -- the questionable files will have two separate extentions. Some specific examples:

fun.mp3.pif
readme.mp3.scr

McAfee offers a solution for detection and removal of this virus (W32/Badtrans@MM) at the following URL:

http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=2608

Click here to go there directly

[Archive]

Posted By: runscott

Another friend complained this afternoon about having the virus, so I sent him the site info - his response had a virus file attached! If you have the virus, do not send out emails until you have cleaned your machine - the virus attaches itself to outgoing emails (the subject won't help you determine if it's a virus email).

[Archive]

Posted By: MW

To all:

I would recommend against using your email service (sending email) until you are inoculated against this virus/worm.

Infected users are prone to a remote access trojan which allows the author of this virus/worm to access sensitive information on your computer (should you have any).

If you have opened an infected file and have received a message that reads, "Install error" or "File data corrupt: probably due to a bad data transmission or bad disk access" then DO NOT send any email until this virus/worm has been removed or the infected files have either been cleaned or deleted.

Most users have either McAfee or Symantec virus software installed on their computers. If your DAT files (virus definition files) have not been updated in the last month, you are susceptible to the W32/Badtras@MM virus. Use either of the links provided above (by me or runscott) to update these files and protect your computer.

[Archive]

Posted By: Lee Behrens

I had to go out in a snow storm to get my Norton Anti-Virus. But I am cured!!!

If only other illnesses were that easy.

Thanks for all the help from everyone!!!!!

Lee