 sj |
||
|
||
Tech: BadTrans virus
|
|
|
Subject: BadTrans virus From: Gypsy Date: 20 Dec 01 - 01:05 AM Help me, going bonkers with this one. The name of the virus is: W32.BadTrans@mm.enc It is a compressed file. I have Norton 2000 antivirus, and while the website acknowleges the existence of this virus, they have no fix. They have a fix for BadTransB, which says specifically that it won't work on any variants. I can find this listed in my virus list, have quarantined and deleted til am blue in the face, and still cannot fix. The symptoms: This came up when checking mail on Outlook Express, before opening anything. I now only recieve my last four emails, and they will double and treble. It does have the grace to tell me that i have multudiouns mail awaiting me. Am going to try to get thru the phone line to Symantech (AGAIN) tomorrow, and pay the exorbitant fee, but am getting desparate. Anyone out there have the answer? Would truly appreciate any help on this one, thanks guys.
|
|
Subject: RE: Help: BadTrans virus From: Gypsy Date: 20 Dec 01 - 01:10 AM Oh yeah, am running Windows, and Outlook Express is the email. Thanks! |
|
Subject: RE: Help: BadTrans virus From: katlaughing Date: 20 Dec 01 - 01:15 AM There is a Removal Tool for this virus at Symantec, HERE. Good luck! After, I would recommend switching from Outlook Express, for which most viruses are written, and use Eudora, instead. I finally did at the urging of several other Mudcatters and I am really happy with it. It's a great email program. Put out by Qualcomm. kat |
|
Subject: RE: Help: BadTrans virus From: Pene Azul Date: 20 Dec 01 - 01:31 AM That removal tool is for a different strain of Badtrans. The Symantec page for W32.BadTrans@mm.enc currently has "no additional information." Maybe they'll have a removal tool for it soon. Jeff |
|
Subject: RE: Help: BadTrans virus From: Herga Kitty Date: 20 Dec 01 - 02:20 AM For those who haven't got it yet, it relies on a loophole in Internet Explorer 5.01 and 5.5. Microsoft have a patch to fix this - try http://www.microsoft.com/technet/security/bulletin/MS01-020.asp Kitty |
|
Subject: RE: Help: BadTrans virus From: BanjoRay Date: 20 Dec 01 - 07:50 AM Norton shifted mine quite easily when I ran it in safe mode, which you enter by repeatedly hitting F8 during boot up. The only problem I had was that my USB mouse wouldn't work in safe mode, so I had to use an old mouse that fit into the mouse socket on my computer. Cheers |
|
Subject: RE: Help: BadTrans virus From: Steve in Idaho Date: 20 Dec 01 - 12:31 PM Here's the (patch) And it recomends you do it immediately - This virus self executes the attachment. Steve |
|
Subject: RE: Help: BadTrans virus From: Gypsy Date: 20 Dec 01 - 12:42 PM That's right, Jeff, i unwittingly tried the patch for BadTransB, and it doesn't work on any variants. Banjo Ray, was this the same virus that you had? If so, will definitly try your way. Did it get rid of it entirely? Thanks! Patch seems to be clogged with others in my plight, will try again in an hour. THanks for all the help, gang. |
|
Subject: RE: Help: BadTrans virus From: Steve in Idaho Date: 20 Dec 01 - 01:19 PM This patch is also only for IE 5.01 and 5.5. All other versions are safe - don't need the patch. Steve Wouldn't you just enjoy chatting with someone who designs these little virus's? |
|
Subject: RE: Help: BadTrans virus From: Steve in Idaho Date: 20 Dec 01 - 01:39 PM Actually if you have the 5.01 or 5.5 update the patch comes with those. Mine was version 5.0 and Jan just downloaded it. Took about 5 minutes including the reboot. Steve |
|
Subject: RE: Help: BadTrans virus From: Mark Clark Date: 20 Dec 01 - 02:25 PM Check out the McAfee description here. They provide a complete description of the virus and manual removal instructions for people who aren't running McAfee VirusScan software. After your problem is fixed, give serious consideration to Kat's suggestion or move your email to hotmail or msn (same mailer) where they perform virus scans before you open the mail.
- Mark |
|
Subject: RE: Help: BadTrans virus From: Steve in Idaho Date: 20 Dec 01 - 03:38 PM I'm wondering if it isn't a big deal because so many people have upgraded to the newer versions. I know my version, 5, has no support from microsoft due to age. I talked with the techs here at the base and they say the best thing to do is upgrade to the 5.5 version of Explorer. I asked them about the version 6.0 and was informed they all use it at home and have had zero problems with it. That would eliminate any of the concerns related to this hole in the woodwork (pardon the pun) *G*. Steve |
|
Subject: RE: Help: BadTrans virus From: Devilmaster Date: 20 Dec 01 - 03:46 PM Another software suite might be pc-cillin. The webpage for your particular virus is here They also have a handy online virus scanner for your computer. Its Housecall Hope it helps. Steve |
|
Subject: RE: Help: BadTrans virus From: Steve in Idaho Date: 20 Dec 01 - 03:51 PM Norton does have a killer for this one - it was put up for download on 12/19. Steve |
|
Subject: RE: Help: BadTrans virus From: Gypsy Date: 20 Dec 01 - 09:19 PM Well, we have been working on this since 11:00 am, and nothing is working. Have tried all fixes, looked in the registry, looked on the drive, everywhere, and still get the same damned message. Have something like 22 messages that i can't access, and it is driving me nuts. Other than throwing it out the window, any bright ideas? Man, would pay big bribes to get this thing fixed. |
|
Subject: RE: Help: BadTrans virus From: Sorcha Date: 20 Dec 01 - 09:25 PM Have you tried "Search" or "Find" (from the start menu) for BadTrans, and delete everything your search shows? |
|
Subject: RE: Help: BadTrans virus From: Gypsy Date: 20 Dec 01 - 11:04 PM Yup, but thanks for the thought! Any other ideas? |
|
Subject: RE: Help: BadTrans virus From: Sorcha Date: 20 Dec 01 - 11:10 PM Well, maybe. Have you tried--Start, Run, Msconfig, then return computer to a date before you had it? Other than that, complete re format of Hard Drive is my only thought. Do you have a re format disc? |
|
Subject: RE: Help: BadTrans virus From: Gypsy Date: 21 Dec 01 - 12:10 AM Hmmmm....haven't tried that yet. Need any special hardware? Am starting to think (in spite of what they say) that this is from my server. Have found NOTHING anywhere with the magick KERN32.exe, and this only comes up with Outlook Express. Anway to delete the mail i haven't yet recieved, in case it is attached to that? |
|
Subject: RE: Help: BadTrans virus From: JohnInKansas Date: 21 Dec 01 - 03:08 AM Norton1 & others I still use IE5, and have found no real difficulty getting support from Microsoft. You do have to go get it, though. Because of an old business email account with MSN, that uses POP3 protocol, we are locked in to IE5 - since MSN tells us that we would have to change the email address, due to POP3 not being compatible with later versions of IE. Most notoriously - with IE5.5. Anyone using IE5 should have downloaded the "SP2" upgrade long ago. Anyone doing any "secure" transactions, and needing "high" encryption, should have upgrades Q295106 and Q306121. You should be able to find the download sites fairly easily by looking for a connection to the "Knowledge Base" from microsoft.com. I'll try to look up more specific directions later, and post them if there is a need; but I would really recommend "wasting" a bit of time looking at what support is there. I haven't looked at the particular virus that originated this thread, but my impression is that the above "fixes" would have prevented it from getting in. - Maybe more on that later. John |
|
Subject: RE: Help: BadTrans virus From: Greg F. Date: 21 Dec 01 - 07:29 AM You can contact your ISP and ask them to dump your mailbox on the server. We had to do that once and it worked a treat here- don't know if it will help in your case. There's days I'm tempted to go back to paper & pen- Best, Greg |
|
Subject: RE: Help: BadTrans virus From: Gypsy Date: 21 Dec 01 - 10:12 AM JIK, believe me, i SCOURED symantech, and microsoft for help on this. They didn't work. However, IT IS FIXED, as of 6:12 am, CA time, i FIXED it! After going into the guts of the computer, and not being able to find the damn worm, finally decided that it was only Outlook that was infected. I deleted the sucker. Cleaned out all traces of it, and the stuff in quarantine. Called my server, got help getting into Eudora (thanks Kat, this was a move UP) and now all is well. If you look carefully at symantech, and microsoft, you will see that they acknowlege my virus, but have no repairs for it. And, all information i've found is saying that viruses are written for Outlook. Hopefully, won't have this problem again for a while. Whatta siege! THanks all. |
|
Subject: RE: Help: BadTrans virus From: Steve in Idaho Date: 21 Dec 01 - 10:29 AM JohnInKansas - You are correct that one can get the support - it just isn't all that easy for those of us with computer illiteracy *G*. And everything you state is absolutely true. One of the things my server allows is for us to go to our server to access our mail. From there we can dump what we don't want without bringing it "home" with us. We aren't always good about it but for the most part I dump anything with an attachment. I also copy and paste anything I think of as important enough to pass on to friends and family. Forwards are a pain in the butt. Bad thing about this turkey is practicing safe computing wouldn't even help. Steve |
|
Subject: RE: Help: BadTrans virus From: Amos Date: 21 Dec 01 - 10:45 AM Doncha gotta wonder about the mental state of someone who would launch shit like this? A |
|
Subject: RE: Help: BadTrans virus From: Gypsy Date: 22 Dec 01 - 12:00 AM I swing between anger for my migraine, and the waste of my time, to pity for someone with such a small, miserable life. My life is so full, with friends, music, and love, that i would never think of hurting someone else. Guess i just want everyone to have my pretty world. |
|
Subject: RE: Help: BadTrans virus From: GUEST,.gargoyle Date: 22 Dec 01 - 12:45 AM Since you hang round here....your world not so "pretty?"
Why people NEVER have "unprotected sex with strangers" ....permit selves to have "unprotected intercourse on the internet" with strangers?
Maybe this your "wakeup call" before something worse happen you....my favorite the "Trojan SubTrans 7" continually morphed to give full access a machine.
BE SAFE!! HAVE FUN!!! |
|
Subject: RE: Help: BadTrans virus From: Gypsy Date: 29 Dec 01 - 08:37 PM Gee, thanks for the advise. Guess that the virus protect program, and the server protect weren't enough. Any advice on what else should do? |
|
Subject: RE: Help: BadTrans virus From: Helen Date: 30 Dec 01 - 05:55 AM Hi Gypsy, I've just had a duel with the BadTrans virus - just over the Christmas break, when my Internet Service Provider was having a break as well. I use Netscape 4.7, and Netscape Communicator for mail, but every time I tried to download my waiting e-mails it would crash Netscape on the first one and then I would get the virus again. I rang the ISP at the earliest opportunity and asked them to delete the first e-mail. I haven't had any problems since then. It seems that the first e-mail was infected and my Norton Anti-virus programme was detecting it and shutting down Netscape each time - so it was doing the right thing. I had to delete my Inbox and re-load Netscape to get the Inbox file back. I could possibly have saved the earlier e-mails in my Inbox, if I had thought of that, because it only seemed to be the latest e-mail, but then again, maybe the whole file was infected. There is some good information on Symantec's site, and one suggestion was to change all your passwords for accessing the 'net, or for internal networks etc. Good luck, and my commiserations. Not unlike the feeling people get when their house is burgled. I felt contaminated, my privacy invaded, and generally just edgy about the whole thing. Helen
|
|
Subject: RE: Help: BadTrans virus From: mack/misophist Date: 30 Dec 01 - 12:06 PM May I add another suggestion? Norton anti-virus can be configured to check for updates automatically every night. You probably missed the virus definition update. Also, some institutional web sites ask that you not upgrade your web browser above Explorer 5.5 or Navigator 4.7 because of problems with the Java applets used on those sites. Both Microsoft and AOL have been rewriting Java for their own purposes and it doesn't always work now. |
|
Subject: RE: Help: BadTrans virus From: Gypsy Date: 30 Dec 01 - 04:29 PM Now Helen, that is a concept. I went overboard (what else is new) and offed outlook express. But your solution would have been far quicker. Misophist, Nortons DID identify the virus, just wouldn't fix it. Or at least, it was listed in the list of virus's that it was supposed to conquer. However, will take your advise about updating daily. I'm on line daily, no reason not to update daily. Thanks, all! :) |
|
Subject: RE: Help: BadTrans virus From: Helen Date: 30 Dec 01 - 06:34 PM Well, Gypsy, I think offing Outlook isn't such a bad idea. The majority of viruses work like a charm in Outlook and not so well in the other Mail programmes. My hubby works for a huge computer company as a computer service engineer and he told me that using Outlook is not good. So I refuse to use it, even though it has some nice features, and I used it in my last job. Also I read a page of questions and answers to do with BadTrans on the Symantec site and they answered the question about why Norton doesn't actually fix the virus, but just recommends deleting the infected file. Good luck with it all. Helen |
|
Subject: RE: Help: BadTrans virus From: Gypsy Date: 30 Dec 01 - 10:35 PM I LOVE it when what i have done is reinforced by an expert. thank you so much for the support. Really am glad now that it happened, cuz i gots Eudora now. |
|
Subject: RE: Help: BadTrans virus From: Helen Date: 31 Dec 01 - 03:44 AM Well, I'm pretty happy with Netscape 4.79. I tried Netscape 6 and it annoyed me so much, and was so slow that I re-loaded my 4.7, and then upgraded to 4.79. All's well that ends well, as long as you keep up to date on virus definitions and virus scanning. also, Happy New Year - it's nearly 8pm here in Oz and I'm just about to go around to my friends' place and then the local social club for a bit of a knees-up. Helen |
|
Subject: RE: Help: BadTrans virus From: Gypsy Date: 31 Dec 01 - 11:02 AM And a happy New Years to you, my friend. It is 8:00 am here, and going to work. party tonight to welcome in new year, with music, fireworks, and laughter. May yours be blessed as am sure ours will be. |
|
Subject: RE: Help: BadTrans virus From: DougR Date: 31 Dec 01 - 11:22 AM Hmmm. I wonder perhaps if Osma Bin Laden might not be in a cave somewhere pounding out these viruses on a laptop and sending them along. It must take that kind of mind ot produce and distribute them. I had an experience over the holidays with Bad Trans B., but was able to download a tool to take care of it. I said bye bye to Outlook Express too. DougR |
|
Subject: RE: Help: BadTrans virus From: Mr Red Date: 16 Jan 02 - 05:32 PM OBL is still pounding, he must know someone who knows someone who knows someone who knows someone who knows someone who knows (tell me when you have had enough) someone who knows someone in NZ. The very virus we are talking about is still multiplying. I had two hits today (my first virus yippee) and one that Norton was unable identify so I will never know. It refused to quarrantine the offenders but I know from the NZ one the schmuck doesn't know me because of the e-mail address. (I use quite a few as an audit trail). On the evidence today Norton still cannot automatically clean the virus (I get auto-updates when I least expect). But at least it knows what it doesn't like. I got shunted to the relevant page at Symantec |
|
Subject: RE: Help: BadTrans virus From: Louie Roy Date: 16 Jan 02 - 06:07 PM Gypsy the only way I know how to get rid of it is simple but it works.You lose all of your emails in your mail box.When you click to go to your emailand it starts to dial left click cancel.Your Virus will show up on your moniter.Delete it now.If it won't delete Norton should put it in quarantine for you,As soon as you get it into quarantine shut your computer down.If it is possible to go down to your server do so for it will be quicker because he will know he is not talking to someone who wants to cause trouble.Have him go to your mailbox and dump everything in it Of course if it isn't posible to go to server call your server and have him dump your mailbox.Once your mail box is dumped go into Norton and it depends how many times you've quarantined this Virus that is how many times you will have to bring the quarantined Virus up and delete it.Hope this helps you Louie Roy |
|
Subject: RE: Help: BadTrans virus From: Louie Roy Date: 17 Jan 02 - 01:01 PM Gypsy I'm anxious to find out how you solved your virus problem.Maybe I didn't make my message clear but the reaon you have to have your PC not connected to your email when you put this in quarantine is it will stay in your email on your PC.Another thing you can quarantine things on your PC but you can't get rid of it at your mailbox at your server and that is why you have to have your server dump your mail box after you have put in quarantine Loui Roy |
|
Subject: RE: Help: BadTrans virus From: Mr Red Date: 17 Jan 02 - 03:13 PM Louie Roy Is that a solution for Norton when it can't cope? my version of Norton (2002 + updates) basically refused to quarrantine but removed all the email except the clues as to it's provenence. Presumeably the text appears as it scripts its dirty business. The other e-mail virus was not identified but Norton refused it or deleted it. If the e-mail was inportant I think the virus crisis is a focussing the senders mind little more than talking to me. The main thing is Norton worked. I have relied on not opening attachments unless I know the sender & not even then for a day. That worked till December & then I figured I had been macho long enough! A wise move but timely? |
|
Subject: RE: Help: BadTrans virus From: Louie Roy Date: 17 Jan 02 - 03:38 PM MR Red My norton is a 2000 aand I don't know whether this is a fix when norton can't cope but it worked for me and was sent to me by a friend who has been installing computer for several years.To me it was a small price to pay all I lost was a few emails in my mailbox at my server.i know of some people in this area who got sent the same virus by someone who they thought was a friend and it costs them a lot more than a few emails.Like I said it works It's simple and it's cheap Louie Roy |
|
Subject: RE: Help: BadTrans virus From: Rustic Rebel Date: 17 Jan 02 - 04:50 PM I had the bad Trans and took me hours to figure out how to get rid of it , but I did it. Have instructions on how if still needed. Also just recently had another that norton didn't pick up called sulfnbk.exe Just have to find it in files and delete from there and then recycle bin. Anyone with outlook should check on that one because it attaches to address books. Yours truly, Rustic |
|
Subject: RE: Help: BadTrans virus From: GUEST Date: 18 Jan 02 - 11:51 AM I rang Microsoft for help on something else - I'd bought a dud Windows 2000 Pro CD from Direct Deals and DD won't give me a replacement. In the course of the conversation, I asked about the Hybris and MTX viruses, which are infecting a PC I have. They pointed me to the Sophos website (www.sophos.com), which has a free 30-day download, with instructions for getting rid of worms. |
|
Subject: RE: Help: BadTrans virus From: Louie Roy Date: 18 Jan 02 - 01:09 PM Rustic Rebel the sulfnbk exe is a hoax and there was a thread on this within the past two months and if you delete it you are deleting part of your PC.Maybe someone can bring up the thread that was on mudcat about this.If you think I am kidding check out this web page on hoaxes http://www.symantec.com/avcenter/hoax.html Louie Roy |
|
Subject: RE: Help: BadTrans virus From: Rustic Rebel Date: 18 Jan 02 - 06:41 PM Thanks for the address Louise Roy. I have deleted it so what does that mean, I've deleted part of my PC? I will have to check into this some more. Thanks. |
|
Subject: RE: Help: BadTrans virus From: Rustic Rebel Date: 18 Jan 02 - 07:09 PM Found that site Louis Roy and they've instructed me on returning the file. I have once again learned a new lesson. Thanks |
|
Subject: RE: Help: BadTrans virus From: GUEST,.gargoyle Date: 19 Jan 02 - 12:29 AM Be thankful for the lessons you have learned. You never would have sought out information without the Mudcat e-mail infection....oh, James Gardner of mediaone you were so helpful with the printer files! Torjan sub Seven....three years out of date ...there are much better refinements. |
|
Subject: RE: Help: BadTrans virus From: Gypsy Date: 19 Jan 02 - 05:05 PM Hey all. Anyway, i got rid of it, by getting rid of Outlook. The way it worked in my case was causing a continuous loop, so never saw the mail to which it was attached.....had nothing to open, so don't know if there was an attachment or not. As it turns out, it never did get into my computer....just the loop in 'express. I'll admit, i certainly know more about the innards of my computer now than i did then. But, i must specify, the patch at Symantech was NOT specific to my case, it only worked on the one virus, not it's variants. I'm really happy with Eudora, just wish i could access my email from it when out of town (as now) But not enough to go back to Outlook |
|
Subject: RE: Help: BadTrans virus From: Mr Red Date: 20 Jan 02 - 08:42 AM sulfnbk.exe handles long filenames (hence the lfn), probably in DOS. The Mudcat thread goes back to July but I would bet it is much older. I vaguely remember a report in the New Scientists. |
| Share Thread: |