Virus/Worm Alert - W32.Bugbear@mm

Systems Affected:

Windows 9.X, ME, NT, 2000, XP
What To Watch For:

Bugbear is spreading via email with random subject lines or through NetBios shares, a feature of Windows. The emails may have attachments with the extensions .exe, .pif, .scr, .bat, .com, .lnk, or .shs.

What This Virus Does:

The virus takes advantage of a security weakness in Microsoft Internet Explorer (v 5.01 or 5.5 without SP2) that allows the attachment to run without specifically opening the file. It will use any email addresses found on the computer and mail itself out with its own email engine. Bugbear will also try to copy itself to the Startup Folder on any shared network machines. Once installed it will try to terminate the processes of many different antivirus and security programs. The virus also contains a backdoor "Trojan" payload that has key logging capability.

What To Do:

Use extreme caution opening any email attachments with the extensions: .exe, .pif, .scr, .bat, .com, .lnk, or .shs. These files have the potential to contain malicious code that may infect your PC with a virus or damage your system.
Run and maintain an antivirus product. It is important to update your antivirus software on a regular basis. Many antivirus packages support automatic updates of virus definitions. We recommend using those automatic updates when available. .
Check for security updates for your operating system and email software with the manufacturer.
Disable NetBios. Go to My Computer/Control Panel/Network, scroll to the TCP/IP listing that includes the name of your network adapter, double-click on it, click the NetBios tab and uncheck the box.
If you feel your computer may have been infected with this virus, see the detailed information provided at the link below, including Removal Instructions about 80% of the way down the page.
Additional Information On This Virus:
How To Get Antivirus Software:

There are many effective antivirus software packages available both at retail software stores and by download from software company websites. Optimum Online subscribers are presently entitled to a 40% discount on the downloadable eTrust EZ Armor security software package from Computer Associates.

More information is available at