To: K-list 
Recieved: 2001/11/26  19:10  
Subject: [K-list] THe trans virus 
From: Final Element J A Livengood
  
On 2001/11/26  19:10, Final Element J A Livengood posted thus to the K-list: It is me_nude .scr from aly AKA Molly ATnospam aol.com. I am going to contact them tomorrow.
 
but in the meantime, it is a new virus, please read this CENTRALCOMMAND.COM Newsletter  
 
Without us, there's no defense. Virus Warning: I-Worm.Badtrans.B
 
Central Command is warning its customers of a new Internet worm  
spreading throughout the world. At this time Central Command is  
issuing a "Medium" risk to this new worm. Details:
 
Name: I-Worm.Badtrans.B 
Aliases: Win32.Badtrans-BATnospammm, W32/BadtransATnospammm 
ITW: Yes 
Risk: Medium Description:
 
I-Worm.Badtrans.B is a new variation of the Internet worm, I- 
Worm.Badtrans.A, a virus that spread via e-mail (a copy of the worm  
was sent as a reply message to all unread emails in the users Inbox  
folder).  
 
The worm arrives in the following e-mail format:
 
Attachment line: A randomly selected messaged built from the  
following list and combinations:  
 
docs, info, Me_nude, 
Card, Humor, Sorry_about_yesterday 
YOU_are_FAT!, stuff, news_doc 
README, images, HAMSTER
 
The first extension selected will be either: *.doc or *.zip or  
*.MP3  
 
Second extension selected will be either: *.scr or *.pif  
 
These are a couple examples of possible choosen subject lines:
 
Me_nude.zip.scr 
README.MP3.pif 
stuff.zip.pif
 
Body: (Blank)
 
If executed, the worm copies itself in the \windows\%system%  
directory under the filename "kernel32.exe".  So that it gets run  
each time a user restart their computer the following registry key  
gets added:  
 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnc  
e\Kernel32 ="kernel32.exe"  
 
Removal:
 
Step 1.) Run a deep scan of your PC and delete any files identified  
as being infected with I-Worm.Badtrans.B  
 
Step 2.) Delete the created registry key listed above Central Command, Inc. respects your online privacy. You at anytime 
can easily remove your e-mail address from the Central Command mailing 
list by entering in your e-mail address at the following web page: 
http://www.centralcommand.com/unsubscribe.html 
  http://www.kundalini-gateway.org 
  
 
 Feel free to submit any questions you might have about what you read here to the Kundalini
mailing list moderators, and/or the author (if given).  Specify if you would like your message forwarded to the list. Please subscribe to the K-list so you can read the responses. 
All email addresses on this site have been spam proofed by the addition of ATnospam in place of the   symbol.
All posts publicly archived with the permission of the people involved. Reproduction for anything other than personal use is prohibited by international copyright law. ©  
This precious archive of experiential wisdom is made available thanks to sponsorship from Fire-Serpent.org.
URL: http://www.kundalini-gateway.org/klist/k2001b/k200105594.html
 |