A new worm has been threading its way through the Internet this month. W32/Badtrans-B has been reported hitting a very large number of users across the globe, and is causing some anti-virus vendors problems in handling the amount of support calls it has generated.
The worm uses a known loophole in Microsoft Outlook, and replicates itself to all users in a victim’s address book, Internet cache and ‘My Documents’ folder in Windows. By disguising itself as a reply to an email found in the victims inbox from the next target, W32/Badtrans-B fools the recipient into thinking it is a genuine mail.
The worm carries a file, with a tell-tale three part attachment name. If the file is executed, the worm alters the registry so that it will launch itself again when Windows is restarted, and will also use a Trojan to try to steal user passwords.
Anti-virus company Sophos reports on its site that it has received so many technical support calls regarding the W32/Badtrans-2 worm that it the company is having trouble responding to calls as promptly as usual.
For more information see: www.sophos.com
