W32.Badtrans.gen@mm

SUMMARY

Due to a decreased rate of submissions, Symantec Security Response has downgraded the threat level of this worm from Category 3 to Category 2 as of May 5, 2003.

This is a MAPI worm that replies to all unread messages in your email message folders and drops a backdoor Trojan.

NOTE: Virus definitions dated prior to October 22, 2001 detected this as W32.Badtrans.13312@mm.

Protection

• Virus Definitions (LiveUpdate™ Weekly) April 11, 2001
• Virus Definitions (Intelligent Updater) April 11, 2001

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 50 - 999
• Number of Sites: More than 10
• Geographical Distribution: High
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Medium
• Large Scale E-mailing: It replies to all unread messages in the message folders within the default MAPI email program.
• Compromises Security Settings: It drops a backdoor Trojan.

Distribution

• Distribution Level: High

TECHNICAL DETAILS

When the worm is executed, it drops the backdoor Trojan Hkk32.exe into the Windows folder and executes it. It then copies itself into the Windows folder as inetd.exe, adds a run= line to the Win.ini file, and displays the following message:



The next time that the computer is restarted, the worm waits for five minutes and then uses MAPI to find all unread email messages and reply to all of them. The worm attaches itself to the message using one of the following file names:
Pics.ZIP.scr
images.pif
README.TXT.pif
New_Napster_Site.DOC.scr
news_doc.scr
hamster.ZIP.scr
YOU_are_FAT!.TXT.pif
searchURL.scr
SETUP.pif
Card.pif
Me_nude.AVI.pif
Sorry_about_yesterday.DOC.pif
s3msong.MP3.pif
docs.scr
Humor.TXT.pif
fun.pif

Recommendations

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

• Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
• If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
• Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

REMOVAL

Because W32.Badtrans.gen@mm affects different operating systems in different ways, how you remove this worm depends on your operating system. Follow the instructions in the order given.

To remove the worm:

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and run a full system scan, making sure that NAV is set to scan all files.
3. Delete any files detected as W32.Badtrans.gen@mm. What you do next depends on whether NAV was able to delete files that it detected as infected with W32.Badtrans.gen@mm:
   • If NAV was able to delete all the files that it detected as infected, do one of the following:
     • If you are running Windows 95/98/Me, skip to the section To edit the Win.ini file.
     • If you are running Windows NT/2000 and NAV was able to delete all the infected files, you are finished.
   • If NAV was not able to delete all files that it detected as infected, go on to the next section and see the instructions for your operating system.

To remove files that cannot be deleted by NAV:
Follow the instructions for your operating system only if NAV could not delete files that it detected as infected with W32.Badtrans.gen@mm.

• Windows 95/98/Me
  1. Restart the computer in Safe Mode. For instructions on how to restart in Safe Mode, see the document How to restart Windows 9x or Windows Me in Safe Mode.
  2. Run the scan again, and delete any files detected as W32.Badtrans.gen@mm.
  3. When the scan is finished, skip to the section To edit the Win.ini file.

• Windows NT/2000/XP
  1. Press Ctrl+Alt+Delete one time.
  2. Click Task Manager.
  3. Click the Processes tab.
  4. Click the "Image Name" column header two times to sort the processes alphabetically.
  5. Scroll through the list and look for inetd.exe. If you find the file, click it and then click End Process.
  6. Scroll through the list and look for Kern32.exe. If you find the file, click it and then click End Process.
  7. Close the Task Manager.
  8. Right-click the My Computer icon on the Windows desktop, and click Explore.
  9. Do one of the following:
     • If you are running Windows NT, click the View menu and click Options.
     • If you are running Windows 2000/XP, click the Tools menu and click Folder Options.
  10. Click the View tab.
  11. Do one of the following:
      • If you are running Windows NT, click "Show all files," uncheck "Hide file extensions for known file types," and then click OK.
      • If you are running Windows 2000/XP, click "Show hidden files and folders" and uncheck "Hide file extensions for known file types."
  12. In the left pane of Windows Explorer, right-click drive C and then click Find (Windows NT) or Search (Windows 2000/XP).
  13. In the In the "Named" or "Search for..." box, type--or copy and paste--the following file names:
      
      inetd.exe  kern32.exe  hkk32.exe  hksdll.dll
      
  14. Click Find Now or Search Now.
  15. When the search is finished, write down the names and locations of the files that are displayed.
  16. Click the Edit menu, and click Select All.
  17. Hold down the Shift key down, and press the Delete key. Continue to hold down the Shift key until you are prompted to confirm the deletion. Click Yes. (Holding the Shift key while pressing the Delete key bypasses the Recycle Bin.)
  18. Close Windows Explorer.
  19. Go on to the section To edit the registry.

To edit the registry:

CAUTION: We strongly recommend that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the keys that are specified. Read the document How to back up the Windows registry for instructions.

1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the key
   
   HKEY_LOCAL_MACHINESoftwareMicrosoft
   WindowsCurrentVersionRunOnce
   
4. In the right pane, delete the value
   
   Kernel32     KERN32.EXE
   
5. Navigate to the key
   
   HKEY_CURRENT_USERSoftwareMicrosoft
   Windows NTCurrentVersionWindows
   
6. In the right pane, delete the value
   
   run     <path>Inetd.exe
   
7. Exit the Registry Editor.
8. Restart the computer.
9. Run the scan again, and delete any files detected as W32.Badtrans.13312@mm. This completes the removal procedure for users of Windows NT/2000.

To edit the Win.ini file:
If you are running Windows 95/98/Me, you must also do the following:

1. Click Start, and click Run.
2. Type the following and then click OK:
   
   edit c:windowswin.ini
   
   NOTE: If you installed Windows in a different location, make the appropriate substitution.
   
3. In the [windows] section, locate the run= line. It will look similar to the following:
   
   run=c:windowsinetd.exe
   
4. Remove the text to the right of the = sign, so that the line now reads
   
   run=
   
5. Save your changes, and exit the MS-DOS Editor.