[unisog] BugBear Worm
Peter Van Epp
vanepp at sfu.ca
Thu Oct 3 23:05:39 GMT 2002
We have certainly seen a handful of machines (some ex of our modem
pool) that have fatally begun scanning port 137 (just before the network
port stops responding :-)). I assume that may be this worm.
Peter Van Epp / Operations and Technical Support
Simon Fraser University, Burnaby, B.C. Canada
> Has anyone encountered this beast yet?
> ISS X-Force claims to be monitoring the spread of the "Bugbear" Internet worm. It propagates through email and through open NetBIOS file shares, attempts to disable all security and antivirus software on each host
> and installs a backdoor program. They claim to have detected a large increase in NetBIOS scanning traffic from several thousand unique addresses.
> For more, check out:
> -Bill Martin-
> Sr. Systems Analyst
> Loyola University Chicago
> bmartin at luc.edu
More information about the unisog