W32/BugBear.B Worm

Download free anti virus software

Anti virus software information

Order anti virus software (US$ 29.95)

Protector Plus
Anti virus software for

Windows
(XP, 2000, 2003, NT, Me, 98, 95)

Exchange

NetWare

W32/BugBear.B Worm

Information about the W32/BugBear.B Worm:

W32/BugBear.B is an email worm. This worm is a variant of BugBear. This worm will infect Windows systems. It spreads using the email addresses present in the infected system.This worm is polymorphic in nature and infects Windows PE files. It also contains a backdoor trojan component that contains key-logging capability.

The email carrying the worm arrives with a random subject. Contents of the mail will be random text. It carries an infected attachment with a random filename having single or double extensions.

The first extension can be any one of these;

EXE
PIF
XLS
BAT
DOC
SCR
JPG
PPS
DBX

The second extension of the infected attachment can be any one of the following extensions;

EXE
PIF
SCR

Upon execution of the attachment, it copies itself to the following folders with a four-letter name to load itself during each system startup.

C:\WINDOWS\Start Menu\Programs\Startup
C:\Documents and Settings\"User-name"\Start Menu\Programs\Startup

"User-name" is a valid user's name present in the system.

The worm tries to search for the presence of the following files in the registry and infects them.

C:\Program Files\ICQ\ICQ.EXE
C:\Program Files\DAP\DAP.EXE
C:\Program Files\WINAMP\WINAMP.EXE
C:\Program Files\AIM95\AIM.EXE
C:\Program Files\LAVASOFT\AD-AWARE 6\AD-WARE.EXE
C:\Program Files\TRILLIAN\TRILLIAN.EXE
C:\Program Files\ZONELABS\ZONEALARM\ZONEALARM.EXE
C:\Program Files\STREAMCAST\MORPHEUS\MORPHEUS.EXE
C:\Program Files\QUCIKTIME\QUICKTIMEPLAYER.EXE
C:\Program Files\WS_FTP\WS_FTP95.EXE
C:\Program Files\MSN MESSENGER\MSGR.EXE
C:\Program Files\ACDSEE32\ACDSEE32.EXE
C:\Program Files\ADOBE\ACROBAT 4.0\READER\ACRORD32.EXE
C:\Program Files\CUTEFTP\CUTEFTP32.EXE
C:\Program Files\FAR\FAR.EXE
C:\Program Files\OUTLOOK EXPRESS\MSIMN.EXE

It also drops files with seven-letter names having the extension .dll in the Windows System folder. This file is used to capture keystrokes.

The worm tries mail itself to all the addresses found in the infected system. The infected email has a fake 'From' address, which is picked randomly from the infected computer. The worm emails itself using the default SMTP engine.

The worm tries to terminate all the processes related to various security software.

This worm first appeared on 5th June 2003.

Other names of W32/BugBear worm:

This worm is also known as W32.Bugbear.B@mm, PE_BUGBEAR.B, W32/Bugbear.b@MM, I-Worm.Tanatos.b

Click here to download a 30 day Evaluation Copy of
Protector Plus anti virus for your operating system

About Protector Plus Anti virus Software Packages:

Proland Software is the developer of Protector Plus range of anti virus software packages. Protector Plus anti virus is available for Windows XP, Windows Me/98/95, Windows NT/2000/2003 servers and workstations, MS-Exchange 2000/2003, MS-DOS and NetWare servers.

Protector Plus range of anti virus products offer on-line virus detection and removal. All the packages have the ability to detect and isolate all types of viruses, trojans, worms and other types of malware. Protector Plus antivirus software can detect and remove W32/BugBear.B worm reliably.

These products are updated on a continuous basis and the latest upgrades for all the platforms are made available for downloading from this site.

You can download the 30 day evaluation copy of
Protector Plus anti virus software free of cost for these platforms:

Windows | Exchange | NetWare

Download free anti virus software | Anti virus software information | Order anti virus software