Tip

Top virus threats, part one



Viruses are not all created equal. Some cause more damage and some spread quickly to a large number of systems. Fortunately, there are only a few viruses that cause lots of damage and spread quickly. Therefore, most viruses are not a big threat. However, those few viruses that are a serious threat is all the reason you need for a multi-level virus protection and removal system.

To help you understand why virus protection is necessary, let's take a quick look at the top four viruses currently found in the wild ("in the wild" means actively infecting computers around the world via the Internet or other means).

One of the worst viruses currently circulating is the W32.Badtrans.B@mm virus. This virus is actually a MAPI worm that automatically e-mails itself to all addresses in the local address book. Each time it mails itself, it also renames itself. Infected systems will have a WindowsSystem32Kdll.dll file which is used to log keystrokes. The keystroke logger only operates for 60 seconds when an open window or dialog box has the following keywords: LOGon, PASsword, REMote, CONnection, TERminal, NETwork. Then, every thirty seconds, the recorded keystrokes are sent to a "drop-box" e-mail address. If an active Internet connection is not available, the worm will wait until Internet connectivity is re-established before transmitting the keystroke log. Obviously, the goal of this worm is to capture logon credentials so they can be used to compromise a

    Requires Free Membership to View

network.

Most antivirus products are able to detect, remove and disable this worm. However, if your system is already infected, you need to manually clean-up its artifacts to guarantee that you will not remain infected or accidentally infect others. For details on reversing the changes to systems infected by the W32.Badtrans.B@mm virus, please see Symantec's documentation regarding this virus at http://securityresponse.symantec.com/avcenter/venc/data/w32.badtrans.b@mm.html

(Note: This tip was derived from materials posted on the Symantec Antivirus Web site at securityresponse.symantec.com/avcenter/. For more information and complete details on these viruses, please visit their site.)


About the author
James Michael Stewart is a researcher and writer for Lanwrights, Inc.


This was first published in March 2002

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.