Bugbear set to stick around

By Matthew Broersma, ZDNet.co.uk, 7 October, 2002 14:06

NEWS

The Bugbear email worm continued to top the virus charts over the weekend, but even though antivirus experts said that it may now be peaking there are signs it won't fade away any time soon. UK email service provider Messagelabs, which hosts email servers around the world, said it intercepted 66,000 messages infected with Bugbear on Friday, with levels falling to 35,000 on Saturday and 34,000 on Sunday as business users logged off. "So far today, it looks like there will be less Bugbear than last week, but we haven't had the United States wake up yet," said Alex Shipp, senior antivirus technologist with Messagelabs. "There are still pretty high levels. We expect to have stopped several tens of thousands by the end of the day." Shipp said that most users do not appear to be upgrading their antivirus software unless they are aware of an infection. This pattern emerged with the Klez virus, variants of which have lingered at the top of Messagelabs' charts since this spring. With the publicity surrounding Bugbear, many Klez victims finally downloaded new software and banished the older worm, but many more have been left vulnerable to Bugbear. Since Bugbear exhibits few symptoms on an infected computer, users may not even take precautions after they have been attacked, Shipp said. Known technically as W32.Bugbear or I-Worm.Tanatos, experts now believe the virus to be a modified version of the earlier Badtrans worm. It installs a backdoor that can be used by hackers to take control of the computer, disables various antivirus measures and any personal firewall that might be present and installs a program for recording keystrokes -- which can log any passwords typed in by the user. It scours the computer for email addresses, to which it sends infected messages via its own email engine. The virus only affects Windows machines. Antivirus experts had been concerned about a secondary wave of attacks as hackers take advantage of the backdoors that Bugbear has installed in thousands of computers, but it now seems that this risk is lower than originally thought. "To exploit the backdoor, an attacker would need knowledge of how it works," Shipp said. "It's difficult to find that out by typing random commands, so the ability to use the backdoor may be limited to the virus author. But that might change if he decides to publish the details of the backdoor on the Web." He noted that the backdoor could be reverse-engineered by other hackers, but that this would take some time. Messagelabs has installed "honeypots" -- computers posing as Bugbear-infected PCs -- but so far has not detected any hackers scanning for Bugbear's backdoor vulnerability. For more information on protecting your PC from Bugbear, and links to antivirus vendors, see ZDNet's Help & HowTo on Bugbear.

For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Security News Section. Have your say instantly, and see what others have said. Go to the Security forum. Let the editors know what you think in the Mailroom.

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

Bill Goodrich : Just as al_langevin pointed out, with Windows Server 2008 there is no Services for Macintosh anymore. It's gone, not available....

3 hours ago by apexwm on Windows Server 2008 drops the ball for Mac compatibility

Replying to an old topic that I'm currently facing with my CEO (who is on a Mac). Our servers are primarily Windows Servers, office is about...

9 hours ago by txtrainguy on Windows Server 2008 drops the ball for Mac compatibility

Sure, that makes perfect sense. Pay wrong-doers money and thank them for breaching your security and pointing out your flaws, that would surely...

9 hours ago by k0tcs3 on US indicts Romanian over NASA climate change hack

I think he's referring specifically to Android apps, as Apple do regulate their App Store, but Google seem to let any old crap onto the Android store!

10 hours ago by Random_Error on RIM: BlackBerry will keep 'garbage' apps out of store

Keep the crap apps out?! How will they compete with Android and Apple's claim to fame of having so many life changing apps? I wonder if the media...

15 hours ago by Paul Fezziwig via Facebook on RIM: BlackBerry will keep 'garbage' apps out of store

It has been shown time after time that if there is an author store that sells the songs at even 1$ per song and gives you a high-quality digital...

16 hours ago by Aigars Mahinovs via Facebook on Copyright isn't working, says European Commission

""As a result of Butyka's alleged conduct, researchers were unable to use the computers for more than two months while NASA removed the malicious...

18 hours ago by awbMaven on US indicts Romanian over NASA climate change hack

It simultaneously worries me and uplifts me that a self-proclaimed group of internet activists name themselves after Indian mythical figures....

1 day ago by subhorup on Anonymous activists release PCAnywhere source code

It's actually far easier to work anonymously on the internet than you think. With tools like Tor bouncing your traffic around the world before...

1 day ago by naviathan on Anonymous activists release PCAnywhere source code

1000272134 and bluedalmatian with you both there but then I'm still in 10.04 land (and happy with it)

1 day ago by Agnostic_OS on Ten factors that make Ubuntu 11.10 a hit

Interesting article and definitely see your points on the products mentioned. One of the top products for our Help Desk (approximately 20% of all...

2 days ago by apexwm on Ten flawed products that derail productivity

Absolutely - this should obviously not be handled my isp - but handled by their hosting operator. What's been suggested here is that my isp police...

2 days ago by Paul Hutchinson via Facebook on MPs urge ISPs to take down terrorist material

Looks like a great phone. I don't notice any deficiencies in WP7. used IOS before, that's pretty good. I don't spend much time in Apps, all i need...

2 days ago by Techs UK on Nokia pins US 're-entry' hopes on Lumia 900

Now with the help of these apps you are always synced with MS outlook while on the move. Just download apps like xobni or outlookreflex and get...

2 days ago by Larry Bloggy via Facebook on Outlook Social Connector beta 2 and the LinkedIn connector

Your details are wrong. The version currently being made is the one with 2 USB ports, 256MB RAM and a network port. This is the Model B. The...

2 days ago by mike40g123 on Raspberry Pi boards set to go on sale

The thing that has been puzzling me for quite a while is how Anonymous can remain anonymous whilst not only being active on the Internet but also...

2 days ago by Moley on Anonymous activists release PCAnywhere source code

If what Semantec is saying is rue, that is even worse and shows a complete disregard for thier users. If what Anonymous claims is true and the...

3 days ago by Don Dilly via Facebook on Anonymous activists release PCAnywhere source code

Didn't seem particularly biased to me either. Oh though you might have mentioned some other competitors with free search and email services...

3 days ago by MattChurchy on Time for an evil umpire: Google, Microsoft & privacy

James - exactly as much as anyone paid you for your comment; I don't feel that I need to say that I'm independant and unbiased, but just for you...

3 days ago by Simon Bisson and Mary Branscombe on Time for an evil umpire: Google, Microsoft & privacy

Once they realise symantec are willing to pay real money, they will simply keep extorting, unless of course symantec/authorities can use the...

3 days ago by Carl White via Facebook on Symantec offered hackers $50k in source code sting

Featured white papers

Latest jobs

Bugbear set to stick around

Daily Newsletters

Topics

Related stories

Bugbear rise knocks out Klez

Bugbear virus threat on the rise

Help & HowTo: Bugbear worm

Data leaks cost Midlothian a record £140k fine

Google-backed DMARC system aims to block phishers

Post your comment

ZDNet UK Live

Latest in Security Management

Data leaks cost Midlothian a record £140k fine

Google-backed DMARC system aims to block phishers

Ten ways to take the sting out of IT disasters

Featured white papers

Latest jobs

MS Office 2010 Trainer - Cambridge

Dynamics CRM Technical Consultant

Product Development Manager - Newcastle upon Tyne

Inside ZDNet UK

Cabinet Office: no lobby influence on open standards

2012 Predictions: VCE FastPath, VI SAN Probe & Hadoop

BlackBerry Bold 9790

2012 Olympics: Is your business prepared?

Ten factors that make Ubuntu 11.10 a hit

Toshiba Portégé Z830-10P Review

BT's archive: Pictures from the vault

News & Analysis

Reviews

Blogs

Resources

About Us

Member Services

Special Features

Advertising Features

ZDNet UK / News and Analysis / Security / Security Management

Bugbear set to stick around

Daily Newsletters

Topics

Related stories

Post your comment

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

Latest in Security Management

Featured white papers

Latest jobs

Inside ZDNet UK

Resources

About Us

Member Services

Special Features

Advertising Features