[unisog] BugBear Worm

Peter Van Epp vanepp at sfu.ca
Thu Oct 3 23:05:39 GMT 2002


	We have certainly seen a handful of machines (some ex of our modem 
pool) that have fatally begun scanning port 137 (just before the network 
port stops responding :-)). I assume that may be this worm.

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada

> 
> Has anyone encountered this beast yet?
> 
> ISS X-Force claims to be monitoring the spread of the "Bugbear" Internet worm. It propagates through email and through open NetBIOS file shares, attempts to disable all security and antivirus software on each host
> and installs a backdoor program. They claim to have detected a large increase in NetBIOS scanning traffic from several thousand unique addresses. 
> 
> For more, check out:
> http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21301 
> 
> -Bill Martin-
> Sr. Systems Analyst
> Loyola University Chicago
> bmartin at luc.edu
> 
> 
> 
> 
> 



More information about the unisog mailing list