As Karen Thompson discovered, viruses like BadTrans can be a real embarrassment - the virus emailed itself to subscribers of her newsletter. Karen noted, "That I was completely unable to control the spread of the virus as long as anyone sent me a single email was the most frustrating aspect of the virus." Like many, Karen downloaded a popular antivirus product from the web, assuming it would take care of the threat. Indeed, InoculateIT did report the virus had been disinfected but though Karen seemed to be doing everything right, the virus would not go away. Each time Karen rebooted, she became reinfected. As it turns out, only one of the three infected files had been cleaned.

So where did Karen go wrong? Essentially, antivirus software can only disinfect files for which it has an exact signature. The copy of InoculateIT had not been updated and thus was not able to accurately identify the offending files. Even though it said the virus was removed, it was not. After following manual removal instructions, Karen was able to defeat the virus.

BadTrans installs itself in such a way to virtually guarantee it's activation on a reboot. For example, on Windows 9x, BadTrans modifies both the Registry and the WIN.INI file to ensure its continued infection. Thus, manual removal on a Windows 9x system entails: