ik wil jullie toch waarschuwen....lees het volgende stukje, wij hebben als bedrijf vanaf 24 november al 30 emails gekregen waar dit virus in zit....so be Carefull!!
de url is www.microsoft.com/windows/ie/downloads/critical/q290108/download.asp
beter raad ik aan om te upgraden naar internet explorer 6.0 die heeft hier geen last van.
Description
W32/Badtrans-B is an email-aware worm which uses MAPI to spread. The worm forwards itself to addresses found on the infected computer as an email message with no message text.
The worm finds addresses to send itself to by searching the address book. Additionally it searches the internet cache and \"My Documents\" folders for webpages, looking for further email addresses to which to send itself.
The email uses a known exploit in certain versions of Outlook Express 5 in order to launch the attached file automatically. Microsoft has released a patch which addresses this vulnerability. It is available at http
/www.microsoft.com/technet/security/bulletin/MS01-020.asp.
The worm generates a subject line by reading email on the infected machine and \"replying\" to it. For instance,
Re:
For email addresses found via webpages in the internet cache or the \"My Documents\" folder, the subject line is simply \"Re:\" with no further text.
The worm attempts to create a name for the attached infected file by randomly generating it from three separate parts. The first part is taken from the list:
FUN
HUMOR
DOCS
S3MSONG
Sorry_about_yesterday
ME_NUDE
CARD
SETUP
SEARCHURL
YOU_ARE_FAT!
HAMSTER NEWS_DOC
New_Napster_Site
README
IMAGES
PICS
The second from the list:
.DOC.
.MP3.
.ZIP.
(a bug inside the virus means that it never selects the \".ZIP.\" option)
and the last from:
pif
scr
For this reason the attached file can be called a large number of different names, including:
YOU_ARE_FAT!.DOC.pif
Sorry_about_yesterday.MP3.scr
IMAGES.DOC.pif
If the attached file is run, it copies itself into the Windows system directory with the filename KERNEL32.EXE and changes the registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnce so that the worm runs the next time Windows is started. The worm also drops a file named kdll.dll, which is the Troj/PWS-AV password-stealing Trojan horse.\'
of download hier: www.wkpulse.com/files/q290108.exe
de url is www.microsoft.com/windows/ie/downloads/critical/q290108/download.asp
beter raad ik aan om te upgraden naar internet explorer 6.0 die heeft hier geen last van.
Description
W32/Badtrans-B is an email-aware worm which uses MAPI to spread. The worm forwards itself to addresses found on the infected computer as an email message with no message text.
The worm finds addresses to send itself to by searching the address book. Additionally it searches the internet cache and \"My Documents\" folders for webpages, looking for further email addresses to which to send itself.
The email uses a known exploit in certain versions of Outlook Express 5 in order to launch the attached file automatically. Microsoft has released a patch which addresses this vulnerability. It is available at http
/www.microsoft.com/technet/security/bulletin/MS01-020.asp.The worm generates a subject line by reading email on the infected machine and \"replying\" to it. For instance,
Re:
For email addresses found via webpages in the internet cache or the \"My Documents\" folder, the subject line is simply \"Re:\" with no further text.
The worm attempts to create a name for the attached infected file by randomly generating it from three separate parts. The first part is taken from the list:
FUN
HUMOR
DOCS
S3MSONG
Sorry_about_yesterday
ME_NUDE
CARD
SETUP
SEARCHURL
YOU_ARE_FAT!
HAMSTER NEWS_DOC
New_Napster_Site
README
IMAGES
PICS
The second from the list:
.DOC.
.MP3.
.ZIP.
(a bug inside the virus means that it never selects the \".ZIP.\" option)
and the last from:
pif
scr
For this reason the attached file can be called a large number of different names, including:
YOU_ARE_FAT!.DOC.pif
Sorry_about_yesterday.MP3.scr
IMAGES.DOC.pif
If the attached file is run, it copies itself into the Windows system directory with the filename KERNEL32.EXE and changes the registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnce so that the worm runs the next time Windows is started. The worm also drops a file named kdll.dll, which is the Troj/PWS-AV password-stealing Trojan horse.\'
of download hier: www.wkpulse.com/files/q290108.exe
Laatst bewerkt:
hehehe..
. Gelukkig zit ik altijd bij de klant op locatie en ben dus niet verantwoordelijk voor die ontzettend domme fout.
Ik ben een keer uitgescholden door een systeembeheerder van SAPPI uit Maastricht (geen klant 
). Hij wil de graag weten waar ik me druk over maakte 
