[unisog] BugBear Worm
SaraciniW at health.missouri.edu
Fri Oct 4 14:03:50 GMT 2002
My earlier message related to Scrup/Oraserv infection - not bugbear. We have not been analyzing the incoming scans for different flavors of the worm-of-the-day.
From: Bill Martin [mailto:bmartin at luc.edu]
Sent: Thursday, October 03, 2002 5:46 PM
To: unisog at SANS.ORG
Cc: Bill Martin
Subject: [unisog] BugBear Worm
Has anyone encountered this beast yet?
ISS X-Force claims to be monitoring the spread of the "Bugbear" Internet worm. It propagates through email and through open NetBIOS file shares, attempts to disable all security and antivirus software on each host
and installs a backdoor program. They claim to have detected a large increase in NetBIOS scanning traffic from several thousand unique addresses.
For more, check out:
Sr. Systems Analyst
Loyola University Chicago
bmartin at luc.edu
More information about the unisog