W32.Bugbear.G@mm

Printer Friendly Page

Discovered: May 25, 2004
Updated: May 26, 2004 6:30:25 AM
Systems Affected: Windows

W32.Bugbear.G@mm is a mass-mailing worm that sends itself to email addresses it gathers from certain files on the system using its own SMTP engine.

This variant may also expose certain confidential information from the infected machine. The email created by this variant will exploit Microsoft Internet Explorer Arbitrary Program Execution Vulnerability (BID 3867) that allows arbitrary execution of code on a remote machine.

Discovered: May 25, 2004
Updated: May 26, 2004 6:30:25 AM
Systems Affected: Windows

W32.Bugbear.G@mm is a mass-mailing worm that sends itself to email addresses it gathers from certain files on the system using its own SMTP engine.
It gets the address to the SMTP server by quering the MX record on the DNS server.

This variant may also expose certain confidential information from the infected machine. The email created by this variant will exploit Microsoft Internet Explorer Arbitrary Program Execution Vulnerability (BID 3867) that allows arbitrary execution of code on a remote machine.


When the worm is executed, it creates the following files:
%System%\zlzxjx.exe
%System%\lzlcmc.dll
%System%\tbtnonb.dll
%System%\[random filename].dll
%temp%\vba[random].tmp
%temp%\$[random].bak (may create multiple files with this name)


It searches for .jpg and .mp3 files in folders with the following names:
BEAR
DONKEY
DOWNLOAD
FTP
HTTDOCS
HTTP
MORPHEUS
ICQ
KAZAA
LIME
MULE
SHAR
UPLOAD

It copies itself into these folders using the file names of the .jpg and .mp3 files found, plus an .exe extension.

It then creates the following registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutodial

It also creates the following registry entry so that it executes every time Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[random value] = %System%\[random filename].exe

The worm terminates any processes with the following strings in their names:
_AVP32.EXE
_AVPCC.EXE_AVPM.EXE
ACKWIN32.EXE
ANTI-TROJAN.EXE
APVXDWIN.EXE
AUTODOWN.EXE
AVCONSOL.EXE
AVE32.EXE
AVGCTRL.EXE
AVKSERV.EXE
AVNT.EXE
AVP.EXE
AVP32.EXE
AVPCC.EXE
AVPDOS32.EXE
AVPM.EXE
AVPTC32.EXE
AVPUPD.EXE
AVSCHED32.EXE
AVWIN95.EXE
AVWUPD32.EXE
BLACKD.EXE
BLACKICE.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
CFINET.EXE
CFINET32.EXE
CLAW95.EXE
CLAW95CF.EXE
CLEANER.EXE
CLEANER3.EXE
DVP95.EXE
DVP95_0.EXE
ECENGINE.EXE
ESAFE.EXE
ESPWATCH.EXE
F-AGNT95.EXE
FINDVIRU.EXE
FPROT.EXE
F-PROT.EXE
F-PROT95.EXE
FP-WIN.EXE
FRW.EXE
F-STOPW.EXE
IAMAPP.EXE
IAMSERV.EXE
IBMASN.EXE
IBMAVSP.EXE
ICLOAD95.EXE
ICLOADNT.EXE
ICMON.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
IFACE.EXE
IOMON98.EXE
JEDI.EXE
LOCKDOWN2000.EXE
LOOKOUT.EXE
LUALL.EXE
MOOLIVE.EXE
MPFTRAY.EXE
N32SCANW.EXE
NAVAPW32.EXE
NAVLU32.EXE
NAVNT.EXE
NAVW32.EXE
NAVWNT.EXE
NISUM.EXE
NMAIN.EXE
NORMIST.EXE
NUPGRADE.EXE
NVC95.EXE
OUTPOST.EXE
PADMIN.EXE
PAVCL.EXE
PAVSCHED.EXE
PAVW.EXE
PCCWIN98.EXE
PCFWALLICON.EXE
PERSFW.EXE
RAV7.EXE
RAV7WIN.EXE
RESCUE.EXE
SAFEWEB.EXE
SCAN32.EXE
SCAN95.EXE
SCANPM.EXE
SCRSCAN.EXE
SERV95.EXE
SMC.EXE
SPHINX.EXE
SWEEP95.EXE
TBSCAN.EXE
TCA.EXE
TDS2-98.EXE
TDS2-NT.EXE
VET95.EXE
VETTRAY.EXE
VSCAN40.EXE
VSECOMR.EXE
VSHWIN32.EXE
VSSTAT.EXE
WEBSCANX.EXE
WFINDV32.EXE
ZONEALARM.EXE

The email message typically has the following properties:
The From address can be spoofed from an address taken from the system. If not, the From address may contain one of the following:
aak
aaron
able
about
above
accept
accident
accounts
accuse
across
act
activist
actor
add
administration
admit
adrian
advise
advisors
advisory
affect
afraid
after
again
against
age
agency
aggression
ago
agree
agriculture
aid
aigua
aija
aim
air
aircraft
airplane
airport
alain
alan
albert
alex
alexander
alfred
alicia
alison
alive
all
allen
ally
almost
alone
along
already
also
although
always
amb
ambassador
amend
amex
amit
ammunition
among
amount
ana
anarchy
ancient
and
anders
andre
andrea
andreas
andres
andrew
andy
ange
angela
angelo
anger
animal
anita
ann
anna
anne
anneli
annette
anniversary
announce
another
answer
anthony
anton
antonio
antti
any
apologize
appeal
appear
appoint
approve
archives
area
argue
arichards
arja
armin
arms
army
arnaud
around
arrest
arrive
art
artillery
arto
ash
ask
assist
astrid
astronaut
asylum
atendimento
atmosphere
atom
attack
attempt
attend
automobile
autumn
awake
award
away
axel
back
bad
balance
ball
balloon
ballot
ban
bank
bar
base
battle
bcooper
bcopep
beach
beat
beatrice
beauty
because
becky
become
bed
beg
begin
behind
believe
bell
belong
below
bennett
benno
berit
bernard
bernd
bernhard
best
betray
better
between
big
bill
bird
birgit
bite
bitter
bjorn
black
blame
blanket
bleed
blind
blm
block
blood
blow
blue
bnelson
boat
bob
body
boil
bomb
bone
bonny
book
border
boris
born
borrow
both
bottle
bottom
box
boy
bpr
brain
brandon
brave
bread
break
breathe
brenda
brian
bridge
brief
bright
bring
brita
britt
broadcast
brother
brown
bruce
bruno
build
bullet
burn
burst
bury
bus
business
busy
but
buy
bwilliams
cabinet
call
callcenter
calm
calvin
camera
campaign
can
cancel
cancer
candidate
cannon
capital
capture
car
cards
cardservice
care
careers
careful
carina
carlos
carol
caroline
carrie
carrier
carry
carsten
case
cat
catch
catherine
cattle
cause
ccarlson
ccook
cdavis
ceasefire
celebrate
cell
celso
center
century
ceo
ceremony
cgrove
chad
chairman
champion
chance
change
charge
charles
charlie
chase
cheat
check
cheer
chemicals
cheryl
chieg
child
choose
chris
christian
christie
christine
christoph
christopher
chuck
church
cindy
circle
citizen
citizens
city
civil
civilian
cjohnson
clash
claude
claudia
clean
clear
clergy
click
clientes
cliff
climb
clock
close
cloth
clothes
cloud
cmiller
coal
coalition
coast
coffee
cold
colin
collect
collins
colony
color
come
comedy
command
comment
comments
committee
common
communicate
communications
company
compete
complete
compromise
computer
concern
condemn
condition
conference
confirm
conflict
congratulate
congress
connect
conny
conservative
consider
contact
contactus
contain
continent
continue
control
convention
cook
cool
cooperate
copy
corporate
correct
correo
cost
costitution
cotton
count
country
court
cover
cow
coward
cporter
craig
craigs
crash
create
creature
credit
crew
crime
criminal
crisis
criticize
crivera
crops
cross
crowd
cruel
crush
cry
cultura
culture
cure
current
custom
customer_service
customerservice
customerservicecenter
customersupport
custserv
cut
cynthia
dale
dam
damage
damien
damir
dan
dana
dance
danger
daniel
daniela
dark
date
daughter
dave
david
day
dead
deaf
deal
deb
debate
debbie
decide
declare
deep
defeat
defend
deficit
degree
delay
delegate
demand
democracy
demonstrate
denis
denise
dennis
denounce
deny
depend
deplore
deploy
derek
describe
desert
design
desire
destroy
details
develop
device
dhall
diana
diane
dick
dictator
die
dietmar
different
difficult
dig
dinner
diplomat
direct
direction
direkt
dirk
dirty
disappear
disarm
discover
discuss
disease
dismiss
dispute
dissident
distance
distant
dive
divide
dnb
doctor
document
dollar
dominic
dominik
don
donald
donna
door
doug
douglas
down
draft
dream
drink
drive
drown
drugs
dry
dsmith
dsnyder
duncan
during
dust
duty
dwilliams
each
earl
early
earn
earth
earthquake
ease
east
easy
eat
eberhard
ecommerce
economy
edda
edge
eduardo
educate
edward
effect
effort
egg
either
elect
electricity
electron
element
elizabeth
ellen
email
embassy
emergency
emmanuel
emotion
employ
employment
empty
end
enemy
energy
enforce
engine
engineer
enjoy
enough
enquiries
enter
eqipment
equal
eric
erica
erich
erick
ericr
erik
erika
ernst
esa
escape
esko
especially
espen
establish
estero
etunimi
eugenio
euro
eva
evan
even
event
ever
every
evidence
evil
evironment
exact
examine
example
excellent
except
exchange
excite
excuse
execute
exile
exist
expand
expect
expel
experiment
expert
explain
explode
explore
export
express
extend
extra
extreme
fabio
face
fact
factory
fail
fair
fall
family
famous
fanatic
far
farm
fast
fat
father
fear
feast
federal
fedwire
feed
feedback
feel
felix
female
fernand
fertile
few
ffb
ffrost
field
fierce
fight
filippo
fill
film
final
finance
find
fine
finish
fire
firm
first
fish
fix
flag
flat
flee
float
flood
floor
florence
flow
flower
fluid
fly
fog
follow
fondazione
food
fool
foot
for
force
foreign
forget
forgive
form
former
forward
foundation
fran
francisco
franco
francois
frank
franz
fred
frederic
free
freeze
fresh
friend
frighten
from
front
fruit
fuel
funds
fundservices
funeral
furious
future
fwilson
gabriele
gain
game
garry
gary
gas
gather
geir
general
gentle
geoff
george
gerald
gerard
gerhard
gerry
get
giancarlo
gift
gilles
girl
gisela
giuseppe
give
glass
glenn
goal
god
gold
good
good-bye
goods
gordon
govern
government
grain
grandfather
grandmother
grass
gray
great
green
Greets!
greg
gregor
gregory
grind
ground
group
grow
guarantee
guard
guenter
guerilla
guide
guilty
gun
gunnar
guy
hair
half
halt
hang
hannes
hans
happen
happy
harald
harbor
hard
harm
harrison
harrrj
hat
hate
hauke
head
headquarters
health
hear
heart
heat
heather
heavy
heidee
heike
heinz
helen
helene
helga
helicopter
helmut
help
helpdesk
henrik
henry
herbert
here
herman
hermann
hernan
hero
hide
high
hijack
hill
history
hit
hold
hole
holger
holiday
holy
home
honest
honor
hope
horrible
horse
horst
hospital
hostage
hostile
hostilities
hot
hotel
hotline
hour
house
how
howard
however
hrdept
hubert
huge
human
humanresources
humor
hunger
hunt
hurry
hurt
husband
ian
icd
ice
ida
idea
ignacio
illegal
imagine
immediate
immo
immobilien
import
impotant
improve
incident
incite
include
increase
independent
industry
inflation
influence
info
inform
information
ingrid
injure
innocent
inquire
insane
insect
inspect
instead
instrument
insult
intelligent
intense
interest
interfere
international
intervene
invade
invent
invest
investigate
investments
investor
invite
involve
irene
irina
iron
isaac
island
issue
ivar
jack
jail
james
jamie
jan
janderson
jane
janet
janice
janna
janne
jason
javier
jay
jcarlos
jennifer
jens
jerome
jerry
jewel
jgray
jhall
jill
jim
jmiller
jmoore
job
jobs
jody
joe
joerg
johan
johann
johannes
john
join
joint
joke
jon
jonathan
jorge
jorgen
jose
josef
joseph
josh
jryan
jsmith
judge
judy
juerg
juergen
juhani
julia
julie
julien
julio
jump
jungle
jury
just
justin
jvasko
jyri
kaija
karen
karin
karl
kathleen
kathryn
kathy
katri
katrin
katy
keep
keith
kelly
ken
kendra
kenneth
kerry
kerstin
kevin
kick
kidnap
kill
kim
kimberly
kind
kiss
kjell
klaus
knife
know
knut
kontakt
kreed
krista
kristin
kristine
kundenservice
kurt
labor
laboratory
lack
lake
land
language
large
larry
lars
last
late
laugh
launch
laur
laura
laurence
lauri
law
lawrence
lbi
lead
leak
learn
leasing
leave
lee
left
legal
lena
lend
leo
leonardo
leopold
less
let
letter
level
lex
liberal
lie
life
light
lightning
like
limit
linda
line
link
liquid
lisa
list
listen
little
liv
live
liz
load
loans
local
lonely
long
look
lori
lose
loud
love
low
loyal
lucera
lucia
luck
ludo
luis
lynn
machine
mad
mail
main
major
majority
make
male
man
manfred
manna
manuel
map
marc
marcelo
march
marco
marcus
margareta
margaretha
marge
margit
maria
marianna
mariano
marie
marina
mario
marion
mark
marker
market
marketing
marks
markus
marlies
mart
martin
mary
mass
material
mathias
mati
matt
matthew
matti
maureen
maurizio
mauro
may
mayor
mclark
mean
measure
meat
media
medicine
meet
melania
melanie
melt
member
memorial
memory
mercenary
mercy
message
metal
method
michael
michaela
michel
microscope
middle
miguel
mihhail
mike
militant
military
milk
mind
mine
mineral
minister
minor
minority
minute
miss
missile
missing
mistake
mix
mlee
mob
moderate
modern
molly
money
monica
month
moon
more
morning
morten
mortgage
most
mother
motion
mountain
mourn
move
much
murder
museum
music
must
mwilliams
mystery
nadine
naked
name
nancy
nation
navy
near
necessary
need
negotiate
neither
nerve
netbank
neutral
never
new
news
next
nice
nick
nicola
nicolas
nicole
night
nils
nina
noise
nominate
noon
norbert
normal
north
not
note
nothing
now
nowhere
nsw
nuclear
number
nuno
nurse
obey
object
observe
occupy
ocean
off
offensive
offer
office
officer
official
often
oil
olaf
olav
old
ole
oliver
olivier
once
online
only
open
operate
opinion
oppose
opposite
oppress
orbit
orchestra
order
organize
osa
other
otto
oust
out
over
overthrow
owe
own
pain
paint
paivi
palace
pam
pamela
pamphlet
pan
paolo
paper
parachute
parade
pardon
parent
parliament
part
party
pass
passenger
passport
past
path
patrice
patricia
patrick
patty
paul
paulo
pay
peace
pedro
pekka
people
percent
perfect
perhaps
period
permanent
permit
person
physics
piano
picture
piece
pilot
pipe
pirate
piret
place
planet
plant
play
please
plenty
plot
poem
point
poison
police
policy
politics
pollute
poor
popular
population
port
position
possess
possible
postpone
pour
power
praise
pray
pregnant
prepare
present
president
press
presse
pressure
prevent
price
priest
prison
privacy
private
prize
probably
problem
produce
professor
program
progress
project
promise
propaganda
property
propose
protect
protest
proud
prove
provide
public
publication
publications
publish
pull
pump
punish
purchase
pure
purpose
push
put
question
questions
quick
quiet
rabbi
race
rachel
radar
radiation
radio
raiba
raid
railroad
rain
rainer
raise
ralf
ralph
randy
rapid
rare
rate
reach
read
ready
real
realistic
reason
reasonable
rebel
receive
recent
recession
recognize
record
red
reduce
reform
refugee
refuse
regret
relations
release
religion
remain
remember
remove
rene
repair
repeat
report
repress
request
rescue
resign
resolution
responsible
rest
restrain
restrict
result
resumes
retire
return
revolt
ricardo
rice
rich
richard
rick
ride
right
rights
riot
rise
rita
river
rlb
road
rob
robbie
robert
roberto
rock
rocket
roger
roland
rolf
roll
ron
ronald
room
rope
rough
round
rsmith
rub
rubber
rudolf
ruin
rule
run
russell
ruth
ryan
sabina
sabine
sabotage
sacrifice
sad
safe
sail
sales
salt
sam
same
sandra
satellit
satisfy
save
say
school
science
scott
scream
sea
sean
search
season
seat
second
secret
security
see
seek
seem
segreteria
seize
sekret
self
sell
senate
send
sense
sentence
separate
serge
series
serious
sermon
serve
service
set
settle
several
severe
sex
shake
shape
share
sharon
sharp
she
shell
shill
shine
ship
shirley
shock
shoe
shoot
short
should
shout
show
shrink
shut
sick
side
sign
signal
sigrid
silence
silver
silvia
similar
simon
simple
since
sing
sink
sister
sit
situation
size
skeleton
skill
skull
sky
slave
sleep
slide
slow
small
smartin
smash
smell
smile
smoke
smooth
snow
social
soft
soldier
solid
solve
some
son
soon
sophie
sorry
sort
sound
south
space
speak
special
speed
spend
sphillips
spill
spilt
spirit
split
sports
spread
spring
spy
stab
staff
stamp
stand
star
start
starve
state
station
statue
stay
steal
steam
steel
stefan
stefano
step
stephane
stephen
steve
steven
stick
still
stock
stomach
stone
stop
store
storm
story
stove
straight
strange
street
stretch
strike
strong
struggle
stubborn
studentloans
study
stupid
submarine
substance
substitute
subversion
succeed
such
sudden
suffer
sugar
summer
sun
supervise
supply
support
suppose
suppress
sure
surplus
surprise
surrender
surround
survive
susan
suspect
suspend
swallow
swear
sweet
swim
sylvia
sympathy
take
talk
tall
tammy
tank
tara
target
tarja
task
taste
tax
tdavis
teach
team
tear
tears
technical
telephone
telescope
television
tell
temperature
temporary
tense
terje
term
terri
terrible
terrie
territory
terror
terry
test
textiles
than
thank
that
the
theater
then
there
thick
thin
thing
think
third
this
thomas
thorsten
threaten
through
throw
tie
tim
time
timmy

tina
tired
tissue
tobias
today
todd
together
tom
tomas
tomorrow
toni
tonight
tony
too
tool
top
torture
touch
toward
town
trade
tradition
tragic
train
traitor
transport
trap
travel
treason
treasure
treat
treaty
tree
trial
tribe
trick
trip
troops
trouble
truce
truck
trust
try
turn
under
understand
unite
universe
university
unless
until
urge
urgent
urmas
urs
use
usual
uwe
valley
value
vanessa
vehicle
version
veto
vicious
victim
victory
village
vincent
violate
violence
violin
visit
vladimir
voice
volcano
volker
vote
voyage
wages
wagner
wait
walk
wall
walter
want
war
warm
warn
warrants
warren
wash
waste
watch
water
wave
way
weak
wealth
weapon
wear
weather
weigh
welcome
well
wendy
werner
west
wet
what
wheat
wheel
when
where
which
while
white
who
why
wide
wife
wild
will
william
willing
win
wind
window
wire
wise
wish
with
withdraw
without
wolfgang
woman
wonder
wood
woods
word
work
world
worry
worse
wound
wreck
write
wrong
year
yellow
yes
yesterday
yet
you
young
TRUE

Subject may be one of the following:
Hello!
update
hmm..
Payment notices
Just a reminder
Correction of errors
history screen
Announcement
various
Introduction
Interesting...
I need help about script!!!
Stats
Please Help...
Report
Membership Confirmation
[Fwd: look] ;-)
Today Only
New Contests
Lost & Found
bad news
wow!
fantastic
click on this!
Market Update Report
empty account
My eBay ads
Cows
25 merchants and rising
CALL FOR INFORMATION!
new reading
Sponsors needed
SCAM alert!!!
Warning!
its easy
free shipping!
News
Daily Email Reminder
Tools For Your Online Business
New bonus in your cash account
Your Gift
Re:
good news!
Your News Alert
Hi!
!!! WARNING !!!

The attachment name is constructed in the format [%s].zip or [%s].htm, where [%s] is a randomly chosen filename from the system.

The worm may also create another e-mail that will be sent to the author of the worm.

The email will have the following subject:
Hello!

And will contain the following types of confidential information obtained from the system:
Cookies
Clipboard
Key logging data
text from window
e-gold details