W32/BugBear Worm

 Information about the W32/BugBear worm:

W32/BugBear is an email worm. This worm will infect Windows systems. It spreads using the email addresses present in the infected system. It also contains a backdoor trojan component that contains key-logging capability.

Click here to download the FREE utility (CleanBB.EXE) to detect and remove the W32/BugBear worm from your computer.

Contents of the mail will be random text. It carries an infected attachment with a random filename having single or double extensions. The extensions can be a combination of .EXE, .PIF, .COM, .BAT, .SCR. Upon execution of the attachment, it copies itself to Windows\System folder. The filename consists of four letters with the first character being 'F', with the extension .EXE . It tries to propagate via email and open network shares. It modifies the registry at the following location to load itself during the next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

It also copies itself to the Windows startup folder with a four-letter name, to load itself during each system startup.

After this it tries to mail itself to all addresses found under the infected system using its own SMTP engine.

The worm tries to terminate all the processes related to various security software.

This worm first appeared on 30th September 2002.

 Other names of W32/BugBear worm:

This worm is also known as Worm/Tanatos, WORM_NATOSTA.A, Win32.Bugbear.