Hi Jaime
For you and any others out there that are interested, the following is exactly what "Badtrans-B" Virus does. It may seem a little long but this is a very complex and malicious Virus. However, if you have an up to date Anti Virus Program then you should be OK. If not, follow the path in my previous posting to get the information regarding removal of the Virus.
Anyway here's the full description:-
W32/Badtrans-B is an email-aware worm which uses MAPI to spread. The worm forwards itself to addresses found on the infected computer as an email message with no message text.
The worm finds addresses to send itself to by searching the address book. Additionally it searches the internet cache and "My Documents" folders for webpages, looking for further email addresses to which to send itself.
If the worm is replying to mail found on the infected machine, it will use the infected user's address in the From: field of the email, otherwise it will use one of the following addresses in the From: field:
" Anna" <aizzo@home.com>
"JUDY" <JUJUB271@AOL.COM>
"Rita Tulliani" <powerpuff@videotron.ca>
"Tina" <tina0828@yahoo.com>
"Kelly Andersen" <Gravity49@aol.com>
" Andy" <andy@hweb-media.com>
"Linda" <lgonzal@hotmail.com>
"Mon S" <spiderroll@hotmail.com>
"Joanna" <joanna@mail.utexas.edu>
"JESSICA BENAVIDES" <jessica@aol.com>
" Administrator" <administrator@border.net>
" Admin" <admin@gte.net>
"Support" <support@cyberramp.net>
"Monika Prado" <monika@telia.com>
"Mary L. Adams" <mary@c-com.net>
The email uses a known exploit in certain versions of Outlook Express 5 in order to launch the attached file automatically. Microsoft has released a patch which reportedly addresses this vulnerability. (see previous post for a link to Microsofts site for the patch)
The worm generates a subject line by reading email on the infected machine and "replying" to it. For instance,
Re: <subject found by reading mail on infected machine>
For email addresses found via webpages in the internet cache or the "My Documents" folder, the subject line is simply "Re:" with no further text.
The worm attempts to create a name for the attached infected file by randomly generating it from three separate parts. The first part is taken from the list:
CARD
DOCS
FUN
HAMSTER
NEWS_DOC
HUMOR
IMAGES
info
ME_NUDE
New_Napster_Site
PICS
README
S3MSONG
SEARCHURL
SETUP
Sorry_about_yesterday
stuff
YOU_ARE_FAT!
The second from the list:
.DOC.
.MP3.
.ZIP.
(a bug inside the worm means that it never selects the ".ZIP." option)
and the last from:
pif
scr
For this reason the attached file can be called a large number of different names, including:
card.DOC.pif
docs.DOC.pif
fun.MP3.pif
HAMSTER.DOC.PIF
Humor.MP3.scr
IMAGES.DOC.pif
Me_nude.MP3.scr
New_Napster_Site.MP3.pif
Pics.DOC.scr
README.MP3.scr
S3MSONG.DOC.scr
SEARCHURL.MP3.pif
SETUP.DOC.scr
Sorry_about_yesterday.MP3.pif
Sorry_about_yesterday.MP3.scr
stuff.MP3.pif
YOU_ARE_FAT!.DOC.pif
YOU_are_FAT!.MP3.scr
If the attached file is run it may copy itself to the Windows or Windows system directory with the filename kernel32.exe and change the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce so that the worm runs the next time Windows is started. Note that the registry key will refer to the original attachment if the worm has not created a copy in the Windows or Windows system directories.
The worm also drops a file named kdll.dll, which is the Troj/PWS-AV password-stealing Trojan horse.
W32/Badtrans-B uses the Trojan Troj/PWS-AV to log a user's keystrokes in a file named cp_25389.nls in the Windows system directory. The log of keystrokes may be encrypted.
W32/Badtrans-B will attempt to send the log to one of the following email addresses:
ZVDOHYIK@yahoo.com
udtzqccc@yahoo.com
DTCELACB@yahoo.com
I1MCH2TH@yahoo.com
WPADJQ12@yahoo.com
fjshd@rambler.ru
smr@eurosport.com
bgnd2@canada.com
muwripa@fairesuivre.com
rmxqpey@latemodels.com
eccles@ballsy.net
suck_my_prick@ijustgotfired.com
suck_my_prick4@ukr.net
thisisno_****ing_good@usa.com
S_Mentis@mail-x-change.com
YJPFJTGZ@excite.com
JGQZCD@excite.com
XHZJ3@excite.com
OZUNYLRL@excite.com
tsnlqd@excite.com
cxkawog@krovatka.net
ssdn@myrealbox.com
So now you have it. Unfortunately there is no short way of describing what it does. Please link to the site in my previous post regarding removal of the virus as its not as simple as just deleting files.
Hope this helps.
David