BugBear, cunning, dangerous, overtaking Klez as #1 (fix included)

Automated PC Solutions

VACM - Virus Alerts for the Common Man



		Bookmark this page:

BugBear, cunning, dangerous, overtaking Klez as #1 (fix included)

Greetings from The VACM Team,

In This Issue:
----------------------
- BugBear, cunning, dangerous, overtaking Klez as #1 (fix included)

Bugbear is also called Tanat, Tanatos, WORM_NATOSTA.A
and W32/Bugbear@MM.

People wishing to subscribe to the VACM Alerts may do so at:
Subscribe to Virus Alerts for the Common Man

BONUS HOW-TO MOVIE!
You have SpyWare on your system! Download our How-To
movie for a simple way of removing SpyWare from your PC (see
the "Tip Of The Day" section below for the download link).

***************************************************
* The Bottom Line...
***************************************************
BugBear includes a keystroke-logging program and a back door.
You do not need to open the attachment to get infected
by BugBear.

BugBear is spreading so fast that it is now overtaking the Klez
virus as the #1 most encountered virus "in the wild".

With its keystroke-logging and back door capabilities, not only
does it send everything you type to the hacker(s) that wrote it,
but it also provides a "back door" through which said hacker(s)
can gain full access to your PC.

Bugbear spreads through e-mail AND through network shares. This
makes it especially dangerous for companies and home users that have
PCs networked together. If just one user becomes infected, BugBear
seeks out other vulnerable PCs on your network and infects them
as well.

It takes advantage of a vulnerability in Internet Explorer in order
to run without the user even double-clicking on the attachment.
The vulnerability that allows it to run has been fixed for over
a year. Have you been installing the VACM-recommended bug fixes
from Microsoft?

This type of worm/virus is why it is so important to install the
bug fixes that VACM advises from time to time. Many viruses would
not affect you at all if you have the correct bug fixes from
Microsoft installed on your computer.

BugBear infected emails arrive with any number of very valid looking
subject lines because it looks at other emails in your inbox, steals
the subject line, composes and sends itself out by pulling fragments
of real e-mails from infected systems and uses them to give its
bogus messages more credibility.

***************************************************
* What You Should Do
***************************************************
1. Make absolutely sure that your antivirus software is up to
date and that it is regularly updating itself, or that you are
updating it every time you go online.

2. Review the VACM Alerts for the past several months and make sure
that you have the latest bug fixes from Microsoft installed.
View the VACM Alerts Archive at http://apcsnh.com/vacm.

3. While at the VACM Archives home page, if you have not already
done so, do all Windows settings that are shown step by step in
the "HowTo" articles near the top of the web page. These are
critical operations that will further "harden" your system
against email and other worms and viruses.

4. Never double-click an attachment. Make sure your AntiVirus
software is completely up to date (our Editor's Choice is
Norton Antivirus 2002), and then right-click on the attachment
and do a "Save As" to save the attachment to your desktop or
other folder. This gives your antivirus software a chance to
scan the attachment before you end up discovering that what
you thought was a JPG picture or some other harmless thing is
actually an executable virus, disguised to look like a
non exectubale file. Read the VACM Alert on File Attachments
to further educate yourself and be sure to do the HowTo on
"Disable Hiding Of File Extensions".

5. BUGBEAR REMOVAL TOOL:
Installing antivirus software after being infected by BugBear
will not be effective. Use the BugBear Removal tool from
Symantec. Be sure to read and follow carefully the instructions
on the Symantec web page. The tool can be downloaded at:

Get the BugBear Removal Tool Here

6. Remember that nearly all virus emails will appear to come from
someone you know! And since BugBear is so good at making its
bogus emails look legitimate by using other emails in an
infected system, please re-read item #4 above.

+++++++++++++++++++++++++++++++++++++++++++++++++++
+ Tip of the day...
+++++++++++++++++++++++++++++++++++++++++++++++++++
+
+ Your system has SpyWare on it, sending your credit card
+ info, usernames, passwords and other "private" information
+ to people you do not know!
+
+ The VACM team has created a How-To movie that shows you
+ exactly how to get the SpyWare off your systems and keep
+ it off.
+
+ Download the movie here:
+
+ http://apcsnh.com/vacm/spywaremovie.htm
+
+ This will download a 20MB self-extractor to your system.
+ Simply save the file to your desktop or other folder,
+ then double-click on it to run it.
+
+ Follow the instructions in the movie and get the SpyWare
+ OFF your system! You will be amazed at how much spyware
+ is on your system, if you are like 99% of our clients.
+
+ REMEMBER: SpyWares are not Viruses. Your antivirus
+ software will NOT keep your system free of SpyWare!
+
+ Please send questions or problem reports to vacm@apcsnh.com
+
+ *****************************************
+ *** Got a valuable tip you'd like to share with our VACM
+ *** subscribers? Send it to us at mailto:vacm@apcsnh.com.
+ *** If we publish your article in a VACM Alert, we will
+ *** send You a FREE Gift- our new "Virus Secrets II - System
+ *** Hardening Guide" on CD-ROM. VS2 is our new, illustrated,
+ *** step-by-step guide to hardening your system against the
+ *** new breed of viruses. Why do you need it? Because
+ *** these days, antivirus software alone does not
+ *** protect you 100% !!
+ *****************************************
+
+++++++++++++++++++++++++++++++++++++++++++++++++++

Best Regards,
Marc Deschenes, VACM Editor
The VACM Project at
Automated PC Solutions

*** Be sure to check out the appendix at the end of this alert
if you are having trouble booting your computer into "Safe Mode".
The process is all spelled out for you there.

Why should you be very
concerned about Spyware?

Learn how to avoid Identity Theft and Windows corruption in this
free VACM Video:
VACM-tested #1 AntiSpyware Software

How did they steal my Identity?

Why do I get so much SPAM ?

Why is your computer
running so slow ?

Today, every PC needs just a few protection softwares. Find out what and why. Visit our Links Page to avoid Indentiry Theft and costly computer repairs.
VACM Links to Protection Tools and Softwares

Keep your PC Safe and
Avoid a costly trip to the shop...
with these VACM approved tools.

You need 3 things to protect your PC(s) automatically. Use these links to go directly to the Download and Purchase pages:

Old Shotgun Shell Boxes
are collector's items and
worth good money!
(yes... just the empty boxes)

get your
ShotShell BlueBook
price guide
now.

To cancel your subscription to VACM, reply to this email with the word UNSUBSCRIBE in the subject.

If you click on the link below, the "unsubscribe" email will be created for you and you can simply hit "Send" in you email program:

Create My Unsubscribe Email

IMPORTANT: please include the email address at which you are currently receiving VACM Alerts in the body of the message.

******** APPENDIX - Handy How-To Tips **********

* How To Boot into Safe Mode

Shut the computer down so that the power is off.

Turn the computer on, wait 1 second and begin pressing the F8 key
on the keyboard, once every second repeatedly. Do this until
the Windows Startup Menu appears. If you get a keyboard
error, press F1 to resume and then continue pressing the
F8 key once every second, or your PC may tell you to press another key for BIOS setup.

Select Safe Mode from the Windows Startup Menu, then press
the Enter key on the keyboard.

Windows will then boot into Safe Mode.
NOTE: This may take longer than a normal boot.

At the end of the boot process a dialog box will appear
informing you that Windows is in Safe Mode. Click OK on this dialog box.

Windows is now in Safe Mode.

If you miss hitting the F8 at the right time, Windows will boot
normally and you will not see the "Safe Mode" message. In this
case, start from the top of these instructions until you get the
boot menu screen where you can choose "Safe Mode". This can be
a little tricky the first time you do it.

Locations of visitors to this page