W32.Bugbear@mm upgraded to level 4 - Symantec alert
SYDNEY --NSW - October 3, 2002 --
| Name: |
W32.Bugbear@mm |
| Category: |
3 |
| Type |
Worm |
| Aliases: |
W32/Bugbear-A [Sophos], WORM_BUGBEAR.A [Trend], Win32.Bugbear
[CA], W32/Bugbear@MM [McAfee], I-Worm.Tanatos [AVP], W32/Bugbear [Panda], Tanatos
[F-Secure] |
| Payload: |
Large-scale emailing: Attempts to mass-mail to addresses harvested
from a compromised host using it's own SMTP engine. Compromises security settings:
May allow unauthorised access to compromised machines. Attempts to terminate
processes of various antivirus and firewall programs. |
| Distribution: |
Subject of email: Variable |
| Name of attachment: |
Variable, with double extension ending in .exe, .scr,
or .pif |
| Size of attachment: |
50,688 bytes |
| Ports: |
36794 |
| Shared drives: |
Attempts to connect to available network resources |
Today Symantec Security Response has upgraded W32.Bugbear@mm from a 3 to a level
4 virus on a scale of 1-5, with 5 being the most serious. The upgrade is due
to the increase of customer submissions to Security Response from customers.
As of yesterday morning, Symantec had a total 157 submissions of the virus from
consumers. This morning, Symantec Security Response has had 2039 submissions
from consumers.
W32.Bugbear@mm can be categorised as a blended threat. It is a mass-mailing
worm and can also spread through network shares. It also has keystroke-logging
and backdoor capabilities and attempts to terminate the processes of various
antivirus and firewall programs. It includes a Trojan that attempts to disable
antivirus and firewall software so it can then attempt to steal the user's passwords
and credit card details. It installs a keylogger on compromised systems to capture
the user's key strokes which could expose usernames and passwords or other confidential
information. It has a bug that causes it to attempt to replicate to network
printers when looking for network drives to infect. This can cause strange print
outs from printers.
Both the subject of the email and the name of the attachment are variable but
the size of the attachment is always 50,688 bytes. The worm's email message
uses one of the following subjects:
Greets!
Get 8 FREE issues - no risk!
Hi!
Your News Alert
$150 FREE Bonus!
Re:
Your Gift
New bonus in your cash account
Tools For Your Online Business
Daily Email Reminder
News
free shipping!
its easy
Warning!
SCAM alert!!!
Sponsors needed
new reading
CALL FOR INFORMATION!
25 merchants and rising
Cows
My eBay ads
empty account
Market Update Report
click on this!
fantastic
wow!
bad news
Lost & Found
New Contests
Today Only
Get a FREE gift!
Membership Confirmation
Report
Please Help...
Stats
I need help about script!!!
Interesting...
Introduction
various
Announcement
history screen
Correction of errors
Just a reminder
Payment notices
hmm..
update
Hello!
All versions of Windows are vulnerable to this worm but users of Macintosh,
Unix and Linux are not.
Virus definitions are available to Symantec customers through LiveUpdate. A
removal tool is also available via Symantec Security Response at
http://securityresponse.symantec.com/avcenter/venc/data/w32.bugbear@mm.html
As usual, Symantec encourages users to download virus definitions on a regular
basis.
|
