Viruses are not all created equal. Some cause more damage and some spread quickly to a large number of systems. Fortunately, there are only a few viruses that cause lots of damage and spread quickly. Therefore, most viruses are not a big threat. However, those few viruses that are a serious threat is all the reason you need for a multi-level virus protection and removal system.
To help you understand why virus protection is necessary, let's take a quick look at the top four viruses currently found in the wild ("in the wild" means actively infecting computers around the world via the Internet or other means).
One of the worst viruses currently circulating is the W32.Badtrans.B@mm virus. This virus is actually a MAPI worm that automatically e-mails itself to all addresses in the local address book. Each time it mails itself, it also renames itself. Infected systems will have a WindowsSystem32Kdll.dll file which is used to log keystrokes. The keystroke logger only operates for 60 seconds when an open window or dialog box has the following keywords: LOGon, PASsword, REMote, CONnection, TERminal, NETwork. Then, every thirty seconds, the recorded keystrokes are sent to a "drop-box" e-mail address. If an active Internet connection is not available, the worm will wait until Internet connectivity is re-established before transmitting the keystroke log. Obviously, the goal of this worm is to capture logon credentials so they can be used to compromise a
Requires Free Membership to View
SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!
Michael S. Mimoso, Editorial Director
network.
Most antivirus products are able to detect, remove and disable this worm. However, if your system is already infected, you need to manually clean-up its artifacts to guarantee that you will not remain infected or accidentally infect others. For details on reversing the changes to systems infected by the W32.Badtrans.B@mm virus, please see Symantec's documentation regarding this virus at http://securityresponse.symantec.com/avcenter/venc/data/w32.badtrans.b@mm.html
(Note: This tip was derived from materials posted on the Symantec Antivirus Web site at securityresponse.symantec.com/avcenter/. For more information and complete details on these viruses, please visit their site.)
About the author
James Michael Stewart is a researcher and writer for Lanwrights, Inc.
This was first published in March 2002