W32/BugBear.B Worm

 Information about the W32/BugBear.B worm:

W32/BugBear.B is an email worm. This worm is a variant of BugBear. This worm will infect Windows systems. It spreads using the email addresses present in the infected system.This worm is polymorphic in nature and infects Windows PE files. It also contains a backdoor trojan component that contains key-logging capability.

The email carrying the worm arrives with a random subject. Contents of the mail will be random text. It carries an infected attachment with a random filename having single or double extensions.

The first extension can be any one of these;

EXE
PIF
XLS
BAT
DOC
SCR
JPG
PPS
DBX

The second extension of the infected attachment can be any one of the following extensions;

EXE
PIF
SCR

Upon execution of the attachment, it copies itself to the following folders with a four-letter name to load itself during each system startup.

C:\WINDOWS\Start Menu\Programs\Startup
C:\Documents and Settings\"User-name"\Start Menu\Programs\Startup

"User-name" is a valid user's name present in the system.

The worm tries to search for the presence of the following files in the registry and infects them.

C:\Program Files\ICQ\ICQ.EXE
C:\Program Files\DAP\DAP.EXE
C:\Program Files\WINAMP\WINAMP.EXE
C:\Program Files\AIM95\AIM.EXE
C:\Program Files\LAVASOFT\AD-AWARE 6\AD-WARE.EXE
C:\Program Files\TRILLIAN\TRILLIAN.EXE
C:\Program Files\ZONELABS\ZONEALARM\ZONEALARM.EXE
C:\Program Files\STREAMCAST\MORPHEUS\MORPHEUS.EXE
C:\Program Files\QUCIKTIME\QUICKTIMEPLAYER.EXE
C:\Program Files\WS_FTP\WS_FTP95.EXE
C:\Program Files\MSN MESSENGER\MSGR.EXE
C:\Program Files\ACDSEE32\ACDSEE32.EXE
C:\Program Files\ADOBE\ACROBAT 4.0\READER\ACRORD32.EXE
C:\Program Files\CUTEFTP\CUTEFTP32.EXE
C:\Program Files\FAR\FAR.EXE
C:\Program Files\OUTLOOK EXPRESS\MSIMN.EXE

It also drops files with seven-letter names having the extension .dll in the Windows System folder. This file is used to capture keystrokes.

The worm tries mail itself to all the addresses found in the infected system. The infected email has a fake 'From' address, which is picked randomly from the infected computer. The worm emails itself using the default SMTP engine.

The worm tries to terminate all the processes related to various security software.

This worm first appeared on 5th June 2003.

 Other names of W32/BugBear worm:

This worm is also known as W32.Bugbear.B@mm, PE_BUGBEAR.B, W32/Bugbear.b@MM, I-Worm.Tanatos.b