‘Badtrans’ Worm Continues Spread

The Symantec Antivirus Research Center (SARC), has upgraded the Badtrans worm to a 4 on a scale of 1 to 5. Trend Micro has it listed as its top threat, surpassing both Nimda and SirCam.

Badtrans comes as an attachment that can automatically launch in some versions of Microsoft Outlook and Outlook Express email programs. Users don’t have to double-click the attachment. Just by previewing it or reading the email, they can become infected.

Badtrans exploits a known flaw in Internet Explorer that is integrated in Outlook. Under normal conditions the flaw was meant to let users open HTML-based email messages. In geek speak, Badtrans uses the MIME header of a message to fool Outlook into opening an executable virus.

The remedy is twofold:

Download the patch for Internet Explorer that will fix the email vulnerability. The versions affected are IE 5.5 or below.

Update the virus definitions for your antivirus programs.

If you’ve been hit with Badtrans, SARC has removal instructions posted.