NWA-PCUG Newsletter Article, November 2002
BugBear Warning
A Dangerous Computer Worm

by Ira Wilsker
ira@apcug.org
(click to email author)


I started writing this week's column on freeware utilities. I just checked my email again, and so far, I have received over 40 copies of the highly dangerous and recently released BugBear computer worm, also being referred to as the Tanatos worm. According to reports published in recent days in the computer media, BugBear has surpassed the infamous Klez in becoming the fastest spreading computer worm or virus in history. Trend and Panda, two major providers of free online virus scans, each now report that nearly 20% of computers infected with malicious code now have the BugBear worm. The Helsinki based antivirus and computer security firm F-Secure rates the BugBear worm as the worst current computer security outbreak. Symantec, publisher of the popular Norton AntiVirus rates the threat as "severe". McAfee considers the risk as "high".

This new worm, or piece of code, is written in the common and popular C++ language, and combines the worst of the Badtrans virus, the Klez worm, and a backdoor Trojan into one extremely dangerous program. Capable of destroying both antivirus software and firewall protection on an infected computer, this nefarious program can also spread rapidly through a network to all computers connected, and through email utilizing its own integral mail program.

Just like the Klez, which until the recent introduction of the BugBear, had been the most rapidly spread virus or worm, BugBear targets the highly publicized security holes in Microsoft's web browser Internet Explorer versions 5, 5.5, and 6, as well as Microsoft's popular email programs Outlook and Outlook Express. Despite the fact that Microsoft released a heavily promoted patch to close these holes about a year ago, and is included in "Windows Update" integral in all versions of Windows since Windows 95 (click on START – WINDOWS UPDATE while online, and download the customized and free "Critical Update" compiled by Microsoft), millions of Windows users have never installed the patch. Now, in exchange for their complacency, these users are at extreme risk of having their personal information stolen by hackers. There is a real chance of having their identity stolen (referred to in law enforcement as "Identity Theft"), private or confidential information accessed, credit card and banking information compromised, and any files on the hard drive available to a hacker to read, modify, or delete at will.

The BugBear, just like the Klez, Yaha, and similar variants, can be activated by simply opening an email containing the malevolent code, or allowing the infected email to appear in the preview pane of any of the unpatched versions of Outlook or Outlook Express. With email programs other than the Outlook series, opening the attachment containing the worm will infect the users' computer. Once infected, antivirus and firewall utilities will be crippled, with no indication of that fact being noticeable by the user. BugBear will then attempt to replicate itself both by repeatedly emailing itself to addresses in the user's address book (the idea of beginning an email address with "!0000" to prevent this is a HOAX), using a variety of subjects, email content, and attachments, as well as sending itself out over a network to all computers so connected. Using the popular human engineering technique of sending the infected emails to addresses in the victim's address book, the malignant messages will appear to be from a person known to the recipient. Multiple references to the worm are written to the registry and ".INI" files, ensuring that BugBear is loaded each time the computer is booted. There are no clearly visible indications to the user that a computer is infected. Once installed on the victim computer, a utility to capture the user's keystrokes is activated, enabling a hacker to see user names, passwords, credit card numbers, and any other information or data entered. A "backdoor Trojan" is activated allowing access to the infected machine, the downloading of the keystrokes by the hacker, and unrestricted access to all files and documents on the computer. Since BugBear itself is transparent, and not apparently destructive, the user will likely never know his computer is infected, and outsiders can access his computer remotely. Antivirus software will still appear to be loaded and updated, and firewalls will appear to function, but in reality they will be useless.

What is a shame is that this infection is easily preventable. Properly updated Microsoft files have significant immunity to the infection. Frequently updated antivirus software offers excellent protection, but only if updated with the BugBear information prior to the infection. Practicing "safe hex" and deleting suspicious emails and attachments before they can appear in a preview pane can greatly reduce the chance of infection.

The free online scans available at housecall.antivirus.com and www.pandasoftware.com can detect and kill Bugbear. Most major antivirus publishers, including Symantec (Norton), F-Prot, and Panda have free utilities available for download that can detect and kill BugBear.

Since BugBear is written in the common C++ language, it is likely that some wicked programmers may modify the code, and create variants to get around the protections offered by recently updated antivirus software, just as what happened with many variants of the Klez worm.

It is a darn shame that I have to do so many columns on the topic of high-tech vandalism, but BugBear is especially insidious. I hope that next week, I can write my column on the topics I originally planned, rather than warning all of you about some new danger.

Ira belongs to, the Golden Triangle PC Club, has a radio show and writes a column for the examiner, and is on the Board of Advisors for APCUG as well as a faculty member of the Lamar Institute. You can email him ira@apcug.org

There is no restriction against any non-profit group using the article as long as it is kept in context, with proper credit given to the author. This article is brought to you by the Editorial Committee of the Association of Personal Computer User Groups (APCUG), an International organization to which this user group belongs.

Click here to return to top



==================================================================