Bubbleboy worm

Download free anti virus software

Anti virus software information

Order anti virus software (US$ 29.95)

Protector Plus
Anti virus software for

Windows
(XP, 2000, 2003, NT, Me, 98, 95)

Exchange

NetWare

BubbleBoy Worm

Information about the BubbleBoy Worm:

BubbleBoy is a worm that spreads using email. It is the first email worm that is able to replicate without the user requiring to open/run any mail attachments. In case of BubbleBoy, the worm activates the moment the email is opened in Outlook. BubbleBoy infects Windows 98 and Windows 2000 computers. It will also work under Windows 95 if Windows Scripting Host is installed. On all these platforms, BubbleBoy will function only if Internet Explorer 5.0 is also installed. BubbleBoy does not run under Windows NT. The worm will not be able to work when the Internet Zone security settings of IE 5 is set to "High" level.

The worm comes as an email. The subject of the email will be "BubbleBoy is back". The worm code is in the message itself and not as an attachment. When the email message is opened, the worm using a security loophole creates a file called "UPDATE.HTA". The worm tries to put this files in the "C:\WINDOWS\START MENU\PROGRAMS\STARTUP" and "C:\WINDOWS\MENU INICIO\PROGRAMAS\INICIO" directories. The presence of the UPDATE.HTA file in the startup directory makes the file to be executed without any security controls the next time the computer is re-started. As the startup directory names are hardcoded, the worm infects only the English and Spanish versions of Windows.

When the UPDATE.HTA file is run, it creates a message containing its code and sends the message to everyone in the address book. The worm sends the message only once. The worm also makes some changes to the registry entries. Finallly the worm displays the following message:

"System error, delete "UPDATE.HTA" from the startup folder to solve this problem."

A patch from Microsoft to fix the loophole used by BubbleBoy is available at:

http://support.microsoft.com/support/kb/articles/Q240/3/08.ASP

Other names of Bubbleboy worm :

This worm is also known as VBS.BubbleBoy.

Click here to download a 30 day Evaluation Copy of
Protector Plus anti virus for your operating system

About Protector Plus Anti virus Software Packages:

Proland Software is the developer of Protector Plus range of anti virus software packages. Protector Plus anti virus is available for Windows XP, Windows Me/98/95, Windows NT/2000/2003 servers and workstations, MS-Exchange 2000/2003, MS-DOS and NetWare servers.

Protector Plus range of anti virus products offer on-line virus detection and removal. All the packages have the ability to detect and isolate all types of viruses, trojans, worms and other types of malware. Protector Plus antivirus software can detect and remove Bubbleboy worm reliably.

These products are updated on a continuous basis and the latest upgrades for all the platforms are made available for downloading from this site.

You can download the 30 day evaluation copy of
Protector Plus anti virus software free of cost for these platforms:

Windows | Exchange | NetWare

Download free anti virus software | Anti virus software information | Order anti virus software