What to do if your PC becomes infected with W32.BadTrans.B

There's another e-mail worm on the loose out there called W32.BadTrans.B@mm.

Like the SirCam worm before it, this worm replicates and sends itself via e-mail to people in your Outlook or Outlook Express address book.

What it does:
The worm e-mails itself out to people in your address book. When they receive the e-mail, it appears to have a valid file attachment named:

HUMOR
DOCS
S3MSONG
ME_NUDE
CARD
SEARCHURL
YOU_ARE_FAT!
NEWS_DOC
IMAGES
PICS

The file also has an extension of .DOC or .MP3, or .ZIP. But it has a further extension of .PIF or .SCR.

For example, it could look like this: ME_NUDE.DOC.PIF.

If opened, it infects a computer and adds this value to the Windows registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
\CurrentVersion\RunOnce\Kernel32=kernel32.exe

It also adds this file Kdll.dll to the c:\windows\system directory. Using this "toolbox," it logs the user's keystrokes and e-mails a record of them to the worm's author.

How to avoid infection:
If you receive an e-mail with the attachment as outlined above, do not open it. Delete it immediately.

Generally, never open attachments that look suspicious and that you are not expecting.

Install an anti-virus program such as McAfee VirusScan or Norton AntiVirus and keep the virus signatures up to date by downloading them from the Internet using the anti-virus program's automated download tool. For example, use "LiveUpdate" in Norton AntiVirus. McAfee VirusScan has a similar feature. McAfee product owners can instead click this link and scroll to the bottom of the page that comes up for instructions.

What to do if your machine is infected:
Install an anti-virus program or update the virus signature on your existing anti-virus program and run it. If you don't own one, download one now:

Click here to use McAfee Virus Clinic to scan your PC for viruses now

OR---->

• Download Norton AntiVirus
• Download McAfee VirusScan
• More McAfee Virus Protection and PC Maintenance Tools
• Order the Norton AntiVirus CD
• Order the McAfee VirusScan CD
  

More resources:

• Symantec W32.Badtrans.B@mm info page
• McAfee W32.Badtrans.B info page
• News.com story about W32.Badtrans.B
• Cyberwalker Virus Portal

If this column still doesn't fully help you with questions about cleaning this worm/virus or if you need personalized help with a problem, please see: Emergency Help.

Finished reading this page? Why not go try out GoToMyPC for free for a month - you can remote control your computer from anywhere. Cyberwalker uses it and thinks it's fantastic!