Network Associates AVERT (Anti Virus Emergency Response Team) heeft vandaag bekend gemaakt dat het de risicobeoordeling van de Bugbear worm heeft verhoogd naar "HIGH", naar aanleiding van een wereldwijd verhoogd aantal meldingen. De onderzoekers van AVERT volgen de verspreiding van Bugbear al enige tijd op de voet en McAfee gebruikers kunnen sinds 30 september de benodigde DAT-files downloaden van de AVERT website op http://vil.nai.com/vil/content/v_99728.htm
Naast de beschikbare DAT-files introduceert Network Associates tevens een nieuwe tool voor reeds besmette computers. Met AVERT Stinger kunnen besmette bedrijven de Bugbear worm verwijderen. AVERT Stinger is een stand-alone programma dat gratis kan worden gedownload van de AVERT website (http://vil.nai.com/vil/stinger/). Het programma is te gebruiken door klanten van alle merken antivirussoftware en is specifiek ontwikkeld om netwerkbeheerders te helpen om besmette computers op te schonen.
"We hebben Bugbear al enige tijd in de gaten, en kwamen eind september al met de benodigde DAT-files waarmee onze klanten zich kunnen beschermen tegen deze worm. Toch zien we dat de worm voor blijft komen, omdat er blijkbaar nog steeds veel bedrijven zijn die hun antvirussoftware niet regelmatig updaten," vertelt Marius van Oers, onderzoeker van AVERT. "Daarom hebben we besloten de risicobeoordeling te verhogen. Wij stellen de software beschikbaar, maar alleen als die ook daadwerkelijk wordt gebruikt, kunnen we zulke uitbraken voorkomen."
"Door Stinger kosteloos beschikbaar te maken voor iedereen die besmet is met Bugbear kunnen we de verdere verspreiding van het virus hopelijk snel stoppen. Stinger werkt onafhankelijk van de geïnstalleerde antivirussoftware en bedrijven hoeven dus geen klant van McAfee te zijn om de software gratis te kunnen gebruiken," aldus Van Oers. "Stinger is natuurlijk geen vervanging voor goede antivirussoftware, en de noodzaak regelmatig te updaten is weer eens onderstreept door Bugbear, maar met Stinger kunnen getroffen bedrijven de schade in ieder geval beperken."
Meer informatie over Bugbear, zoals hoe de worm te herkennen en vervolgens te verwijderen, treft u aan in het onderstaande persbericht. De Stinger software kunt u gratis downloaden van de AVERT website, op http://vil.nai.com/vil/stinger/.
Als u met een expert van AVERT zou willen spreken over Bugbear en Stinger kunt u natuurlijk altijd contact opnemen met Applied Communications.
Met vriendelijke groet,
Jurriaan Trommels
Account Executive
Applied Communications
T: +31 20 531 3743
F: +31 20 531 37 01
E: jurriaan@appliedcom.com
www.appliedcom.com
*****************************************
Member of WhiteOaks International
Amsterdam - Barcelona - London - Madrid - Milan - Munich - Paris - San Francisco
******************************************
Virus Alert: Network Associates AVERT Places High Risk Assessment On Bugbear Worm
W32/Bugbear@MM - Mass-Mailing Worm Alters Security Program Settings
BEAVERTON, Ore., Oct. 3 -- Due to an increase in prevalence, AVERT (Anti-Virus Emergency Response Team), the world-class anti-virus research division of Network Associates, Inc. (NYSE: NET), today assigned a High risk assessment to the recently discovered W32/Bugbear@MM, also known as Bugbear. Bugbear is a destructive mass-mailing worm that spreads via network shares and by emailing itself to the user's local address book. It also contains a backdoor Trojan component that contains keylogging functionality. It was first reported to McAfee AVERT UK research Lab Monday morning, and has been found in numerous countries including the United States, Australia, India, Brazil and throughout Western Europe.
Symptoms Bugbear is an Internet worm that once activated, emails itself to addresses found on the local system in the user's address book. When run on the victim's machine, Bugbear copies itself into the Window Directory System as a random executable file with the file extension .EXE. The Local Machine Registry key is set in order to hook next system startup. The worm then copies itself to the Startup folder on the victim's machine as ***.EXE, where "***" is a random file. Because Bugbear utilizes numerous subject headers, users should immediately delete email containing the following:
Subject:
- - Found
- - Daily Email Reminder
- - Just a reminder
- - Lost
- - Market Update Report
- - Membership Confirmation
- - Your News Alert
To view the complete list of potential email subject lines, please visit the description page on AVERT's site at: http://vil.nai.com/vil/content/v_99728.htm .
Body of email: The message body varies and may contain fragments of files found on the victim's system. The attachment name also varies, but my contain strings including:
- - Card
- - Docs
- - Image
- - Music
- - Photo
- - Pics
- - Readme
- - Resume
- - Video
It is common for the attachment name to contain a double-extension such as doc.pif. Outgoing messages make use of the incorrect MIME header in Microsoft Internet Explorer, which can cause IE to execute email attachments in version 5.01 or 5.5 without SP2.
Trojan component Bugbear opens a port on the victim machine -- port 36794 and searches for various running processes, stopping them if found. The list of processes includes many popular AV and personal firewall products. It drops a DLL on the victim machine -- keylogger related. This DLL is detected as PWS-Hooker.dll. Once Bugbear infects a computer system, it will attempt to terminate the process of the system's security programs. For example:
- - ACKWIN32.exe
- - CLEANER.exe
- - ESPWATCH.exe
- - FINDVIRU.exe
- - F-AGNT95.exe
- - NAVAPW32.exe
- - RESCUE.exe
- - SAFEWEB.exe
- - ZONEALARM
To view the complete list security programs affected, please visit the description page on AVERT's site at: http://vil.nai.com/vil/content/v_99728.htm . There have been reports that after execution of Bugbear, it will send print jobs to all network printers.
Cure
Immediate information and cure for this virus can be found online at the McAfee AVERT site at http://vil.nai.com/vil/content/v_99728.htm . McAfee VirusScan users should update their systems from that page and use the 4226 or 4227 DAT file to stop potential damage.
AVERT Labs is one of the top-ranked anti-virus research organizations in the world, employing more than 90 researchers in offices on five continents. AVERT protects customers by providing cures that are developed through the combined efforts of AVERT researchers and AVERT AutoImmune technology, which applies advanced heuristics, generic detection, and ActiveDAT technology to generate cures for previously undiscovered viruses.
With headquarters in Santa Clara, Calif., Network Associates, Inc. is a leading supplier of network security and availability solutions. Network Associates is comprised of three product groups: McAfee Security, delivering world-class anti-virus and security products; Sniffer Technologies, a leader in network availability and system security; and Magic Solutions, a leader in innovative service management solutions. For more information, Network Associates can be reached at 972-308-9960 or on the Internet at http://www.nai.com .