NWA-PCUG Newsletter Article, February 2003
BugBear -- Have You Had Your Turn Yet?
by Bill Shook, Editor
(click to email author)

Let me tell you about it -- at least the version that decided to camp with me.

I don't know how long I had it -- oh yes, every once in a while I'd get a glitch or so but nothing to interrupt operations. I'm still not sure just how much BugBear had to do with the glitches. What led me to it was trying to upgrade Norton Anti-virus(NAV) 2003 from 2002. It installed ok, but when double clicking on the icon to open it so I could update the virus definitions, the first screen would come up ok, but momentarily would disappear and the program wasn't running.

I didn't have this problem with anything but NAV, so at first I didn't think of a virus causing it. Unloading and reloading it had no effect. So I went to Symantec(Norton) website and couldn't find anything on it, then went to the Norton support unmanned "assistant" to let them try to diagnose it. They looked at my machine and came back saying, "your virus definitions are very delinquent and need to be updated immediately for your protection!" Of course I knew that. But they said they'd assist in running the definitions if I wanted. They tried, but just as soon as the program started, it dropped out, just like it did for me off line.

That's as far as they went, so I spent some time trying to exhaust their next few screens looking for a way to contact them, which I eventually did. It took about 3 days for them to get back with me but when they did, it was worthwhile.

They said this problem was usually do to a virus and pointed me to one of their URLs http://service1.symantec.com/support/nav.nsf/docid/2002042212142906?Open&src=w, that my initial search of their site would have found if I knew what words to search for. Their title for this section was "The program interface appears briefly and then disappears when starting Norton AntiVirus." My reaction was -- NOW I know! I was probably too quick to give up on the search or I'd probably have searched on "disappears, or something else." Who knows.

Their solution was as follows, in the order listed:

  • 1) Rule out an infection by W32.Klez.
  • 2) Rule out an infection by another virus.
  • 3) If the computer has not been infected, then uninstall NAV.
  • 4) Clean boot the computer.
  • 5) Reinstall NAV.

Then they went on for a multitude of pages with details on how- to for everything.

Everything came up clean after running the Klez removal tool ( FixKlez.com).

Then I was faced with a "battlefield" decision. The net of what they said to do to rule out infection by another virus, was to run the virus scan program. Keep in mind the reason I'm into this is because my virus program WON'T RUN. I figured I could always reload NAV 2002, but my logic says it should do the same as 2003 -- disappear. Also, if it would run, from past experience I knew it would take a day or so to run a complete scan. I wasn't that patient. So, I figured I'd start by ruling out the viruses I knew were going around today. The first that came to mind was BugBear (W32.Bugbear@mm) and I seem to remember seeing some mention of this on my infected drive somewhere in the recent past, but I couldn't recall where, why, how, or when, so it might be a good idea to run the removal tool (FxBgbear.exe).

Guess what? The FxBgbear.exe removal tool found and removed 6 occasions of BugBear, by deleting four windows files and two values from a registry key and leaving a final statement of:

"W32.Bugbear@mm has been successfully removed from your computer!"

Click here to return to top