Newsgroup: it.economia.borsa
Titolo: [OT] BadTrans


su punto informatico avevano smentito questa cosa


Email messages use the malformed MIME exploit to allow the attachment to
execute in Microsoft Outlook without prompting. For information on this, go
to:
http://www.microsoft.com/technet/security/bulletin/MS01-020.asp
The worm writes email addresses to the %System%\Protocol.dll file to prevent
multiple emails to the same person. Additionally, the sender's email address
will have the "_" character prepended to it, to prevent replying to infected
mails to warn the sender (eg 
us...@website.com
 becomes _
us...@website.com
).
After sending mail, the worm adds the value
Kernel32   kernel32.exe
to the registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This will run the worm the next time that you start Windows.
Removal instructions:
To remove this worm, follow the instructions for your operating system.
Basic instructions
Windows 95/98/Me
  1. Restart Windows in Safe Mode
  2. Run Norton AntiVirus and delete all files that are detected as
W32.Badtrans.B@mm.
  3. Remove the value that it added to the registry.
Windows NT/2000/XP
  1. Restart Windows in VGA mode.
  2. Run Norton AntiVirus and delete all files that are detected as
W32.Badtrans.B@mm.
  3. Remove the value that it added to the registry.
To remove files that cannot be deleted by NAV:
Follow the instructions for your version of Windows only if NAV could not
delete files that it detected as infected with W32.Badtrans.B@mm.
    a.. Windows 95/98/Me
    1. Restart the computer in Safe Mode. For instructions on how to restart
in Safe Mode, see the document How to restart Windows 9x or Windows Me in
Safe Mode.
    2. Run the scan again, and delete any files detected as
W32.Badtrans.B@mm.
    3. When the scan is finished, go on to the section To edit the registry.
    a.. Windows NT/2000/XP
    1. Press Ctrl+Alt+Delete one time.
    2. Click Task Manager.
    3. Click the Processes tab.
    4. Click the "Image Name" column header two times to sort the processes
alphabetically.
    5. Scroll through the list and look for kernel32.exe. If you find the
file, click it and then click End Process.
    6. Close the Task Manager.
    7. Run the scan again, and delete any files detected as
W32.Badtrans.B@mm.
    8. When the scan is finished, go on to the section To edit the registry.
To edit the registry:
CAUTION: We strongly recommend that you back up the system registry before
you make any changes. Incorrect changes to the registry could result in
permanent data loss or corrupted files. Please make sure that you modify
only the keys that are specified. Please see the document How to back up the
Windows registry before you proceed. This document is available from the
Symantec Fax-on-Demand system. In the U.S. and Canada, call 
(541) 984-2490
,
select option 2, and then request document 927002.
  1. Click Start, and click Run. The Run dialog box appears.
  2. Type regedit and then click OK. The Registry Editor opens.
  3. Navigate to the following key:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
  4. In the right pane, delete the following value:
  Kernel32   kernel32.exe
  5. Click Registry, and then click Exit.
Additional information:
Prevention
  a.. Corporate email filtering systems should block all email that have
attachments with the extensions .scr and .pif.
  b.. Home users should not open any email that has an attachment in which
the second extension is .pif or .scr. Any email that has such an attachment
should be deleted.


so che avevano smentito
ma se il virus  ( io lo avevo) l'ho debellato col tol chiuso  e non ho
digitato password mentre lo avevo posso essere  tranquila no??
o no?

 ha scritto nel messaggio
news:9u3io6$5v050$1...@ID-53989.news.dfncis.de...

Ciao,in teoria si,perň,visto che č stato studiato da pochi giorni,stai
attenta e controlla ogni tanto con l'antivirus.
Controlla anche il Registro:
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
affinchč non ci sia piů il "kernel132.exe"
Io ho adottato da tempo una rubrica mia personale,su una cartella di Windows
2000,a cui ho dato un nome di fantasia,dove metto gli indirizzi piů
importanti
e ho criptato la cartella.
Cordialmente.
GioSusa