Badtrans.A worm

 Virus Information - Badtrans.A worm:

Badtrans is a mass mailing email worm. This worm will infect Windows systems. Badtrans.A spreads through MS-Outlook or Outlook Express.

The worm arrives with the subject as reply to an email sent earlier by you with a prefix 'Re:'. Infected mail carries an attachment with one of the following names:

news_doc.scr
Pics.ZIP.scr
fun.pif
images.pif
README.TXT.pif
Humor.TXT.pif
Sorry_about_yesterday.DOC.pif
New_Napster_Site.DOC.scr
hamster.ZIP.scr
s3msong.MP3.pif
YOU_are_FAT!.TXT.pif
searchURL.scr
SETUP.pif
Card.pif
Me_nude.AVI.pif
docs.scr

When the infected attachment is executed it copies itself to the WINDOWS directory as Inetd.exe. It also modifies WIN.INI to load itself during next Windows startup. After this it replies to all unread emails messages and attached itself with the logged user name as sender. The Badtrans.