[unisog] BugBear Worm

Saracini, Bill SaraciniW at health.missouri.edu
Fri Oct 4 14:03:50 GMT 2002

My earlier message related to Scrup/Oraserv infection - not bugbear.  We have not been analyzing the incoming scans for different flavors of the worm-of-the-day.


-----Original Message-----
From: Bill Martin [mailto:bmartin at luc.edu]
Sent: Thursday, October 03, 2002 5:46 PM
To: unisog at SANS.ORG
Cc: Bill Martin
Subject: [unisog] BugBear Worm

Has anyone encountered this beast yet?

ISS X-Force claims to be monitoring the spread of the "Bugbear" Internet worm. It propagates through email and through open NetBIOS file shares, attempts to disable all security and antivirus software on each host
and installs a backdoor program. They claim to have detected a large increase in NetBIOS scanning traffic from several thousand unique addresses. 

For more, check out:

-Bill Martin-
Sr. Systems Analyst
Loyola University Chicago
bmartin at luc.edu

More information about the unisog mailing list