Resolve for W32/Badtrans Free Download

Resolve for W32/Badtrans Ranking & Summary

Ranking: Click at the star to rank
User Review: 0 ( times ) Download now
File Size: 83 KB
OS: Windows All
License: Freeware
Publisher: Sophos Plc

Resolve for W32/Badtrans Tags

Resolve for W32/Badtrans Description

Resolve is the name for a set of small, downloadable Sophos utilities designed to remove and undo the changes made by certain viruses, Trojans and worms. They terminate any virus processes and reset any registry keys that the virus changed. Existing infections can be cleaned up quickly and easily, both on individual workstations and over networks with large numbers of computers.W32/Badtrans-A is a worm which uses MAPI to spread. The worm arrives in an email message with the text "Take a look to the attachment". The attachment filename is randomly chosen from the following list: fun.pifHumor.TXT.pifdocs.scrs3msong.MP3.pifSorry_about_yesterday.DOC.pifMe_nude.AVI.pifCard.pifSETUP.pifsearchURL.scrYOU_are_FAT!.TXT.pifhamster.ZIP.scrnews_doc.scrNew_Napster_Site.DOC.SCRREADME.TXT.pifimages.pifPics.ZIP.scr If the attached file is run, it displays the message "File data corrupt probably due to bad data transmission or bad disk access.", copies itself into the Windows directory with the filename INETD.EXE and changes win.ini so that the file is run at Windows startup. When a new message arrives the worm sends a reply with an infected attachment. The worm also drops a file kern32.exe, which is a password-stealing Trojan, Troj/Keylog-C, into the Windows system directory and changes the registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnce so that the Trojan runs at Windows startup. W32/Badtrans-B is an email-aware worm which uses MAPI to spread. The worm forwards itself to addresses found on the infected computer as an email message with no message text. The worm finds addresses to send itself to by searching the address book. Additionally it searches the internet cache and "My Documents" folders for web pages, looking for further email addresses to which to send itself. If the worm is replying to mail found on the infected machine, it will use the infected user's address in the From: field of the email, otherwise it will use one of the following addresses in the From: field: " Anna" "JUDY" "Rita Tulliani" "Tina" "Kelly Andersen" " Andy" "Linda" "Mon S" "Joanna" "JESSICA BENAVIDES" " Administrator" " Admin" "Support" "Monika Prado" "Mary L. Adams" The email uses a known exploit in certain versions of Outlook Express 5 in order to launch the attached file automatically. Microsoft has released a patch which reportedly addresses this vulnerability. It is available at patch fixes a number of vulnerabilities in Microsoft's software, including the one exploited by this worm.) The worm generates a subject line by reading email on the infected machine and "replying" to it. For instance, Re: For email addresses found via web pages in the internet cache or the "My Documents" folder, the subject line is simply "Re:" with no further text. The worm attempts to create a name for the attached infected file by randomly generating it from three separate parts. The first part is taken from the list: CARDDOCSFUNHAMSTERNEWS_DOCHUMORIMAGESinfoME_NUDENew_Napster_SitePICSREADMES3MSONGSEARCHURLSETUPSorry_about_yesterdaystuffYOU_ARE_FAT! The second from the list: .DOC..MP3..ZIP. (a bug inside the worm means that it never selects the ".ZIP." option) and the last from: pifscr For this reason the attached file can be called a large number of different names, including: card.DOC.pifdocs.DOC.piffun.MP3.pifHAMSTER.DOC.PIFHumor.MP3.scrIMAGES.DOC.pifMe_nude.MP3.scrNew_Napster_Site.MP3.pifPics.DOC.scrREADME.MP3.scrS3MSONG.DOC.scrSEARCHURL.MP3.pifSETUP.DOC.scrSorry_about_yesterday.MP3.pifSorry_about_yesterday.MP3.scrstuff.MP3.pifYOU_ARE_FAT!.DOC.pifYOU_are_FAT!.MP3.scr If the attached file is run it may copy itself to the Windows or Windows system directory with the filename kernel32.exe and change the registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnce so that the worm runs the next time Windows is started. Note that the registry key will refer to the original attachment if the worm has not created a copy in the Windows or Windows system directories. The worm also drops a file named kdll.dll, which is the Troj/PWS-AV password-stealing Trojan horse. W32/Badtrans-B uses the Trojan Troj/PWS-AV to log a user's keystrokes in a file named cp_25389.nls in the Windows system directory. The log of keystrokes may be encrypted. W32/Badtrans-B will attempt to send the log to one of the following email addresses: ZVDOHYIK@yahoo.comudtzqccc@yahoo.comDTCELACB@yahoo.comI1MCH2TH@yahoo.comWPADJQ12@yahoo.comfjshd@rambler.rusmr@eurosport.combgnd2@canada.commuwripa@fairesuivre.comrmxqpey@latem W32/Badtrans-A and W32/Badtrans-B can be removed from Windows computers automatically with the following Resolve tools:Windows disinfectorBADTRGUI is a disinfector for standalone Windows computers. To use it you have to do the following:· Open file from your desktop after downloading it.· Click on the Start Scan Button.· Wait for the process to complete.Command line disinfectorBADTRSFX.EXE is a self-extracting archive containing BADTRCLI, a Resolve command line disinfector for use on Windows networks. After removing the worm you should install the Microsoft patch MS01-027 or, on single computers, update with all relevant security patches from Windows update.

Resolve for W32/Badtrans Related Software

Remover for W32.Badtrans A cleaning tool that erases W32.Badtrans File size: 265 KB
Download now
Virus virus protection Trojan DLL Remover virus cleaner  
Resolve for W32/Apribot-C A tool that removes W32/Apribot-C File size: 76 KB
Download now
Remove Remover Malware Cleaner virus protection  
Resolve for W32/Anig A tool that removes W32/Anig File size: 75 KB
Download now
Virus antivirus protection trojan remover trojan protection  
Resolve for W32/Apology-B A tool that removes W32/Apology-B File size: 71 KB
Download now
Virus Malware Cleaner Trojan virus remover  
Resolve for W32/Avril A tool that removes W32/Avril File size: 78 KB
Download now
Protection virus protection Trojan trojan remover  

Resolve for W32/Badtrans Company

Sophos Plc

Company Information:

Resolve for W32/Badtrans Reviews