Badtrans is back, but don't panic

A new variant of the damaging Badtrans internet worm has emerged over the weekend, prompting security experts to remind IT managers to update antivirus software and warn staff to look out for suspicious attachments.

Security specialist McAfee said that the 'B' variant of the W32/Badtrans@MM worm, or Badtrans.b, is a mass-mailing internet worm, like the Melissa and Lovebug viruses before it, that attempts to send itself using Microsoft Outlook by replying to unread emails.

Badtrans first surfaced in April. When executed, it drops a remote access Trojan, or RAT, into the user's Windows directory, which attempts to mail the victim's internet protocol (IP) address to the author.

David Emm, product marketing manager for McAfee, which has been tracking the new-variant virus for about a month, said that the subject and body text may vary, but will come with an attachment that is 13,312 bytes in length and will take a number of forms including the following:

S3MSONG.DOC.scr
Pics.DOC.scr
HUMOR.MP3.scr
Sorry_about_yesterday.MP3.pif
README.MP3.scr
ME_NUDE.MP3.scr
fun.MP3.pif
NEWS_DOC.DOC.scr
docs.DOC.pif
images.DOC.pif
HAMSTER.DOC.pif
SEARCHURL.MP3.pif

"At the moment we're not saying the situation is serious, we're just warning people that it's out there," said Emm.

"Home users are particularly affected, but as ever it's just a question of reminding people to update their antivirus software and beware of mysterious attachments or messages from people they don't recognise."