Bugbear set to stick around

By Matthew Broersma, ZDNet.co.uk, 7 October, 2002 14:06

NEWS

The Bugbear email worm continued to top the virus charts over the weekend, but even though antivirus experts said that it may now be peaking there are signs it won't fade away any time soon. UK email service provider Messagelabs, which hosts email servers around the world, said it intercepted 66,000 messages infected with Bugbear on Friday, with levels falling to 35,000 on Saturday and 34,000 on Sunday as business users logged off. "So far today, it looks like there will be less Bugbear than last week, but we haven't had the United States wake up yet," said Alex Shipp, senior antivirus technologist with Messagelabs. "There are still pretty high levels. We expect to have stopped several tens of thousands by the end of the day." Shipp said that most users do not appear to be upgrading their antivirus software unless they are aware of an infection. This pattern emerged with the Klez virus, variants of which have lingered at the top of Messagelabs' charts since this spring. With the publicity surrounding Bugbear, many Klez victims finally downloaded new software and banished the older worm, but many more have been left vulnerable to Bugbear. Since Bugbear exhibits few symptoms on an infected computer, users may not even take precautions after they have been attacked, Shipp said. Known technically as W32.Bugbear or I-Worm.Tanatos, experts now believe the virus to be a modified version of the earlier Badtrans worm. It installs a backdoor that can be used by hackers to take control of the computer, disables various antivirus measures and any personal firewall that might be present and installs a program for recording keystrokes -- which can log any passwords typed in by the user. It scours the computer for email addresses, to which it sends infected messages via its own email engine. The virus only affects Windows machines. Antivirus experts had been concerned about a secondary wave of attacks as hackers take advantage of the backdoors that Bugbear has installed in thousands of computers, but it now seems that this risk is lower than originally thought. "To exploit the backdoor, an attacker would need knowledge of how it works," Shipp said. "It's difficult to find that out by typing random commands, so the ability to use the backdoor may be limited to the virus author. But that might change if he decides to publish the details of the backdoor on the Web." He noted that the backdoor could be reverse-engineered by other hackers, but that this would take some time. Messagelabs has installed "honeypots" -- computers posing as Bugbear-infected PCs -- but so far has not detected any hackers scanning for Bugbear's backdoor vulnerability. For more information on protecting your PC from Bugbear, and links to antivirus vendors, see ZDNet's Help & HowTo on Bugbear.

For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Security News Section. Have your say instantly, and see what others have said. Go to the Security forum. Let the editors know what you think in the Mailroom.

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

Hello ALL USERS OF THE PIRATE BAY I WOULD PUT AN EXPLANATION ON PIRACY Story Idea ILLIGALE AND SHARING THOSE THAT NET Dissent NOT WELL BUT TO CA...

5 hours ago by dede0202 on The Pirate Bay infringes copyright, High Court decides

do You know that? it can install 4G Ram. So i buy 4g and install It work! I can run call of duty 4,6,7 [Modern war... 1,2,3] Call of duty 1 was...

5 hours ago by Sungwoo on Loose Ends - Upgrading the Aspire One 522

2. Bad idea. Making up patch cables loses you your commission from the cable supplier. 3. If you tidy up, other people can understand where the...

11 hours ago by itsajob on Ten IT jobs to save up for those rare lulls

Now On Sale, Unlocked iPhone 4S / Galaxy Note In Factory Box. Roberto-Techie(UK) ”Now on Sales” Smartphone, Android,Tablets,Gadget &...

15 hours ago by Roberto_Store on Samsung Galaxy S III lined up for sale

Is this classic FUD? One thing I would definitely have notice is a Mozilla threat to stop supporting GNU/Linux.

17 hours ago by Paul Smyth via Facebook on Firefox rapid release improves Fedora Linux

I agree with the previous commenter wholeheartedly. I couldn't say it better myself. This is very 'Big Brother'. And while I agree with protecting...

21 hours ago by UnderINK on European e-identity plan to be unveiled this month

Nice to see that Turing's idea of a general purpose computer doing once-hardware-powered tasks in software is now universal ;-) Mary

1 day ago by Simon Bisson and Mary Branscombe on Software with everything

seriously now. I've only bothered to read a small bit of the comments. do me and the rest of the world a favour. stop saying it does not work or...

1 day ago by Jason Burchell via Facebook on Music industry negotiating over 24-bit downloads

Read about it and weep, John Donahoe ... In addition to Visa’s V.me, there is now MasterCard’s PayPass digital wallet soon to arrive; another...

1 day ago by Philip Charles Cohen via Facebook on PayPal takes phone-based payments to the high street

Leslie Satenstein : Where have you ever seen Mozilla even mention this? Firefox is the most popular browser in the GNU/Linux OS, so I don't see...

1 day ago by apexwm on Firefox rapid release improves Fedora Linux

SHleG: Do you remember building a clockwork scorpion kit (I'm pretty sure I have a photo of it somewhere) — I think it was called something like...

2 days ago by songmaster on Software with everything

Good I love Yahoo! Their search engine is getting better than Google as of late. I find more of what I want on the first page, and usually within...

2 days ago by Chris Wortman via Facebook on Linux Mint 13 ramps up for KDE release

openhgs has made the point for Windows 8 multiple monitors without realising it! With Windows 7 you have to switch the mouse and so your focus...

2 days ago by PatrickG on Windows 8 could speed multi-monitor uptake

Mozilla has threatened to stop supporting Linux. I guess that UBUNTU is going with another browser. I indicated that if Mozilla stops supporting...

2 days ago by Leslie Satenstein via Facebook on Firefox rapid release improves Fedora Linux

Much as I abhor Microsoft's licensing practices, this is almost certainly down to purchasing IT equipment via 3rd party consultants - you get the...

2 days ago by Andy Bolstridge via Facebook on 6 million wasted licences and £1,200 PCs: welcome to government IT

@openhgs Windows users have had multiple desktops since Linus started writing Linux. They just haven't shipped as standard because not enough...

2 days ago by Jack Schofield on Windows 8 could speed multi-monitor uptake

@Phil at Cloud4 What, Microsoft gets £1,200 per PC and £1,622 per server? Gosh, I'm amazed....

2 days ago by Jack Schofield on 6 million wasted licences and £1,200 PCs: welcome to government IT

You guys have no idea what is going on at Autonomy. Autonomy could have been a much more profitable organization. The sales operations at Autonomy...

2 days ago by craigsc on HP cuts 27,000 staff as Autonomy chief Lynch leaves

How does this impact on dual or multi booting? Seems to me to more or less prohibit this, from Windows 8 anyway. Will Grub 2 recognise Windows 8,...

2 days ago by Moley on Windows 8 start-up speed forces USB boot workaround

I don't understand why there cannot be a slight pause during the boot process so the user can press a key. Many operating systems do this, even if...

3 days ago by apexwm on Windows 8 start-up speed forces USB boot workaround

Featured white papers

Latest jobs

Bugbear set to stick around

Daily Newsletters

Topics

Related stories

Bugbear rise knocks out Klez

Bugbear virus threat on the rise

Help & HowTo: Bugbear worm

NHS patients' health data to be anonymised and shared

Apple releases Flashback tool for Mac OS X 10.5

Post your comment

ZDNet UK Live

Latest in Security Management

NHS patients' health data to be anonymised and shared

Apple releases Flashback tool for Mac OS X 10.5

IPv6 security: What you need to know

Featured white papers

Latest jobs

Senior Business Analyst

Technical Project Manager

Software Support Engineer

Inside ZDNet UK

Indoor navigation coming to a mobile near you soon

Software with everything

Asus Transformer Pad TF300T

How IT is ganging up on organised cybercrime

HTC One V: First take

SharePoint deployment: The final chapter

Ten IT jobs to save up for those rare lulls

News & Analysis

Reviews

Blogs

Resources

About Us

Member Services

Special Features

Advertising Features

ZDNet UK / News and Analysis / Security / Security Management

Bugbear set to stick around

Daily Newsletters

Topics

Related stories

Post your comment

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

Latest in Security Management

Featured white papers

Latest jobs

Inside ZDNet UK

Resources

About Us

Member Services

Special Features

Advertising Features