Name : kern32.exe
Path : %SYSTEM%\kern32.exe
[ C:\Windows\System32\kern32.exe ]
type : Internet
Name : W32.Bandtrans.A@mm
Alias : I-Worm.Badtrans, W32/Bandtrans-A,
level : Low
Ken32.exe belongs to W32.Bandtrans.A@mm.
It is an encrypted worm spreads via MAPI function
of Microsoft Outlook and it also drops Trojan.PSW.Hooker.b
in the victims PC. The virus author can steal
username and password details using the password
W32.Bandtrans.A@mm arrives as an e-mail
attachment, when the infected e-mail attachment
is executed, it will display the following
message box and copies itself to the file INETD.EXE
in the windows folder.
The worm also decrypts
and drops KERN32.EXE and HKSDLL.DLL in the
Windows system folder. It adds "RUN=INETD.EXE"
entry in WIN.INI file to load on the next startup.
The password stealer is activated on next startup
by adding the following key in the registry
On the next startup, it
attempts to mail all unread messages in the
Microsoft Outlook folders. The worm attachment
name will be one of the following.
How can I protect my
Solo has incorporated ken32.exe in its signature file to
protect users from this worm attack. Solo
antivirus registered users are already protected
from this worm. Make sure that you have installed
registered version of Solo Antivirus to protect
your system from all virus threats.
to remove this worm?
can check the system manually. W32.Bandtrans.A@mm worm
creates the file "INETD.EXE"
in the Windows folder and "KERN32.EXE",
"HKSDLL.DLL" in the Windows system
folder. The presence of these files ensures you
are infected with this worm.
you are already infected with kern32.exe process,
you can remove it from your computer using Solo
Antivirus software. Solo antivirus can
detect and remove W32.BadTrans.A@mm safely.
Use the following link to Download 30 day
trial version of Solo antivirus to
remove viruses from your computer.
Solo anti-virus not only
scans for all viruses, it contains a unique System
Integrity Checker to protect you from
New Internet Worms, Backdoors and
malicious VB, Java Scripts. It also
effectively removes all existing Internet Worms,
File viruses, malicious VB, Java scripts, Trojans,
Backdoors, boot sector, partition table and macro
purchase Solo antivirus using the link