[unisog] BugBear Worm

William D. Colburn (aka Schlake) wcolburn at nmt.edu
Fri Oct 4 13:51:37 GMT 2002

According to my virus milter I've blocked 69 of them in the past 168
hours.  I don't think any of them have made it into my network yet.

I can provide a copy if anyone needs one.

On Thu, Oct 03, 2002 at 05:46:20PM -0500, Bill Martin wrote:
> List-Digest-Subscribe: <mailto:unisog-digest-subscribe at sans.org>
> List-Digest-Unsubscribe: <mailto:unisog-digest-unsubscribe at sans.org>
> Date: Thu, 03 Oct 2002 17:46:20 -0500
> From: "Bill Martin" <bmartin at luc.edu>
> To: <unisog at sans.org>
> Cc: "Bill Martin" <bmartin at luc.edu>
> Subject: [unisog] BugBear Worm
> Has anyone encountered this beast yet?
> ISS X-Force claims to be monitoring the spread of the "Bugbear" Internet worm. It propagates through email and through open NetBIOS file shares, attempts to disable all security and antivirus software on each host
> and installs a backdoor program. They claim to have detected a large increase in NetBIOS scanning traffic from several thousand unique addresses. 
> For more, check out:
> http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21301 
> -Bill Martin-
> Sr. Systems Analyst
> Loyola University Chicago
> bmartin at luc.edu

William Colburn, "Sysprog" <wcolburn at nmt.edu>
Computer Center, New Mexico Institute of Mining and Technology
http://www.nmt.edu/tcc/     http://www.nmt.edu/~wcolburn

More information about the unisog mailing list