View source for Badtrans

{{short description|Computer virus}}{{Infobox computer virus|fullname=BadTrans|type=[[Computer worm]]|origin=East Asia (allegedly)|OSes=[[Windows 95]], [[Windows 98]], [[Windows ME]], [[Windows NT]], [[Windows 2000]], [[Windows XP]]|subtype=Mass-mailer|isolation_date=November 24, 2001}}

'''BadTrans''' is a malicious [[Microsoft Windows]] [[computer worm]] distributed by [[e-mail]]. Because of a known vulnerability in older versions of [[Internet Explorer]] (CVE-2001-0154), some email programs, such as Microsoft's [[Outlook Express]] and [[Microsoft Outlook]] programs, may install and execute the worm as soon as the e-mail message is viewed.

Once executed, the worm replicates by sending copies of itself to other e-mail addresses found on the host's machine, and installs a [[keystroke logging|keystroke logger]], which then captures everything typed on the affected computer.  Badtrans then transmits the data to one of several e-mail addresses.<ref name=Cert_badtrans_2001>{{cite web
|author=Kevin Houle, Chad Dougherty
|title=W32/BadTrans Worm
|url=http://www.cert.org/incident_notes/IN-2001-14.html
|date=2001-11-27
|access-date=2001-12-01
| archive-url= https://web.archive.org/web/20011217014735/http://www.cert.org/incident_notes/IN-2001-14.html| archive-date= 17 December 2001 | url-status= live}}</ref> 

Among the e-mail addresses that received the keyloggers were free addresses at [[Excite (web portal)|Excite]], [[Yahoo!|Yahoo]], and IJustGotFired.com.

The target address at IJustGotFired began receiving emails at 3:23pm on November 24, 2001.  Once the account exceeded its quotas, it was automatically disabled, but the messages were still saved as they arrived.  The address received over 100,000 keylogs in the first day alone.<ref name=H2K2_badtrans>{{cite web
|author=HOPE Wiki
|title=H2K2/Talks
|url=http://wiki.hope.net/H2K2/Talks#Magic_Lantern_and_Other_Evil_Things
|date=2010-06-21
|access-date=2011-05-30
|archive-url=https://web.archive.org/web/20110703041238/http://wiki.hope.net/H2K2/Talks#Magic_Lantern_and_Other_Evil_Things
|archive-date=2011-07-03
|url-status=dead
}}</ref>

In mid-December, the [[FBI]] contacted [[Rudy Rucker, Jr.]], owner of MonkeyBrains, and requested a copy of the keylogged data. All of that data was stolen from the victims of the worm; it includes no information about the creator of Badtrans.
Instead of complying with the FBI request, MonkeyBrains published a database website, https://web.archive.org/web/20070621140432/https://badtrans.monkeybrains.net/ for the public to determine if a given address has been compromised.  The database does not reveal the actual passwords or keylogged data.<ref name=SFBG_Rucker_2000>{{cite web
|author=A.C. Thompson
|title=Directing traffic
|url=http://www.sfbg.com/36/12/fbi.html
|date=2000-12-18
|access-date=2011-01-11
}}</ref>
==References==
{{Reflist}}

{{DEFAULTSORT:Badtrans (Computer Worm)}}
[[Category:Email worms]]