|
||
 |
||
|
| How To Get Rid Of… |
 Email This
 Print ThisView My Personal Library |
|
How To Get Rid Of… Article Last Reviewed February 2005 |
 How To Get Rid Of BugBear.B | ||
 Description The Bugbear.B (aka Tanatos.B) worm, which surfaced in June 2003, is a variant of the original Bugbear worm released in the fall of 2002. This is a mass-emailing worm that also spreads through LAN (local-area network) shares, allowing it to propagate across a network. It will not only email itself to addresses found in the infected machine, but it will also go a step further and disable some antivirus and firewall products. As if that's not bad enough, Bugbear.B can also install a keylogger program (potentially grabbing users' passwords and other sensitive information) and then install a backdoor program to allow access to the infected machine from a remote location across the Internet. The worm spoofs the address of the sender with a random address and uses its own SMTP (Simple Mail Transfer Protocol) engine to send email from the infected computer. The attachment name is a filename borrowed from files found on the infected machine and is known to have a .PIF, .EXE, or .SCR extension. The virus can affect computers running Windows 9x/NT/Me/2000/XP. How To Tell If Bugbear.B Is Present On Your PC Bugbear.B will attempt to copy itself to your system's STARTUP folder so that it activates automatically upon the next system restart. The presence of any unusual file names with an .EXE extension (such as XXXX.exe with XXXX representing random letters that the worm chooses) in the STARTUP folder should be considered suspect. For example, the worm may copy itself as C:\WINDOWS\STARTMENU\PROGRAMS\STARTUP\AAbb.exe when it runs on a Win9x/Me-based computer or C:\DOCUMENTS AND SETTINGS\ CURRENT USERNAME\START MENU\PROGRAMS\STARTUP\Ccdd.exe when it runs on a WinNT/2000/XP-based system. After copying itself to the startup folder of the local machine, it will attempt to copy itself to the startup folder of other machines on the network. Bugbear.B may also install a keylogger and backdoor component with the file name of these components randomly generated with a DLL extension and placed in the C:\WINDOWS\SYSTEM or C:\WINNT\SYSTEM directory. The information collected by the keylogger component is placed in two similarly named files, also in the SYSTEM directory. Bugbear.B will use the backdoor component to listen on TCP (Transmission Control Protocol) port 1080. SOCKS proxy servers quite frequently use port 1080. (Network administrators usually provide these Web servers as a security measure and to provide a faster Web surfing experience.) If your computer is not acting as a proxy server, the presence of activity at port 1080 may be an indication that Bugbear.B has infected your computer. If this occurs, a hacker can then connect to the port 1080 backdoor and perform any of several actions, such as uploading or downloading files, deleting files, or starting the keylogger component. To see if this port is in use, click Start, click Run, type netstat in the Open box, and click OK. This action uses the NETSTAT command (indigenous to all Windows versions) to list all the open connections to and from your PC. Lastly, Bugbear.B will attempt to copy itself to any available network resource, including shared printers, causing them to print out the worm's code. Presence of this anomaly can signify you've been infected. WARNING: The following section includes step-by-step information on how to edit the Windows Registry, a large database containing system and program settings that are essential to how the OS (operating system) operates. Follow Registry-editing instructions to the letter and be sure to make a backup of your Registry before you begin (Registry errors can render your computer inoperable if you don't have a backup). This procedure differs depending on the OS you use. For more information on backing up and editing the Registry, see these articles: "Protect Yourself" and "Register Here." |
|
Home Copyright & Legal Information Privacy Policy Site Map Contact Us