What is BugBear.C worm and How Did I Get It?

Bugbear.C is a variant of Bugbear, which spreads as an email attachment and steals information from an infected computer.

When Bugbear.C runs, it does the following:

1. Copies itself as %System%\<random filename>.exe.
   
    
2. Drops three files as %System%\<random name>.dll.
   
   One of the .dll files will be detected as PWS.Hooker.Trojan. This file should be deleted. The other two files are not malicious.
   
    
3. Adds the registry key:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutodial
   
    
4. Attempts to add the value:
   
   "<random value>" = "%System%\<random filename>.exe"
   
   in the registry key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   
   so that the worm starts the next time Windows starts.
   
    
5. Attempts to terminate the following processes:
   
   _AVP32.EXE
   _AVPCC.EXE
   _AVPM.EXE
   ACKWIN32.EXE
   ANTI-TROJAN.EXE
   APVXDWIN.EXE
   AUTODOWN.EXE
   AVCONSOL.EXE
   AVE32.EXE
   AVGCTRL.EXE
   AVKSERV.EXE
   AVNT.EXE
   AVP.EXE
   ......
   
    
6. Collects email address from the email program's Inbox and from the files with these extensions:
   • .ODS
   • .MMF
   • .NCH
   • .MBX
   • .EML
   • .TBB
   • .DBX
     
      
7. Uses its own SMTP engine to email itself to the email addresses that it collected.
   
   The email will have the following characteristics:
    
   • From: The "From" address will either be spoofed from the collected email addresses, or it will be created from a list of words that is carried by the worm. This list has over 1,900 entries. A copy of the list, in comma-delimited format, is in the Additional Information section at the end of this page.
      
   • Subject: One of the following:
     • Hello!
     • update
     • hmm..
     • Payment notices
     • Just a reminder
     • Correction of errors
     • history screen
     • Announcement
     • ......
       
        
   • Attachment: The file name of the attachment will be randomly selected from a file that is found on an infected computer.
     
     It will have one of these extensions:
     • .zip
     • .htm
       
        
8. Locates personal information and sends it to the attacker.
   
   This information can include:
   • Cookies
   • Clipboard contents
   • Key logging data
   • Text from open windows.

How to Remove the BugBear.C Worm?

Kaspersky Internet Security Can Prevent You From Virus and Intrusion. If Kaspersky detects Bugbear.C during the scan, it will AUTOMATICALLY offer you the option of deleting it. Do this by following the program's instructions.

Follow these steps in removing the Bugbear.C worm.

1. Disabling System Restore (Windows Me/XP)

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles: "How to disable or enable Windows Me/XP System Restore".

2. Updating the virus definitions

If you do not know which anti-virus software can provide strong protection for you, Kaspersky Internet Security is recommended.

3. Identifying the Malware Program

To remove this malware, first identify the malware program.

1. Scan your system with your Pnada antivirus product.
2. NOTE all files detected as BUGBEAR.C.

4. Terminating the Malware Program

1. Open Windows Task Manager.
   On Windows 95/98/ME systems, press
   CTRL+ALT+DELETE
   On Windows NT/2000/XP systems, press
   CTRL+SHIFT+ESC, then click the Processes tab.
2. In the list of running programs*, locate the malware file or files detected earlier.
3. Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
4. Do the same for all detected malware files in the list of running processes.
5. To check if the malware process has been terminated, close Task Manager, and then open it again.
6. Close Task Manager.

5. Removing Autostart Entries from the Registry

To remove the malware autostart entries:

1. Open Registry Editor. Click Start>Run, type Regedit then hit Enter.
2. In the left panel, double click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>
   Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry or entries whose data value is the malware path and file name of the file/s detected earlier.
4. Close Registry Editor.

6. Scanning for and deleting the infected files

1. Start your Kaspersky Internet Security and make sure that it is configured to scan all the files.
2. Run a full system scan.
3. If any files are detected as infected with Bugbear.C, click Delete.

How to Disinfect My Computer from Worms?

In order to keep your computer protected, bear the following tips in mind:

1. If you have filtering tools installed, configure them to reject messages with the characteristics described above. If, in spite of doing this, you receive the message that contains the virus: do not open it, do not run the attached file and delete it, making sure that you also delete it from the Deleted Items folder.
2. Install a good antivirus in your computer. Select Kaspersky Internet Security to get the Kaspersky antivirus solution that best suits your needs.
3. Keep your antivirus updated. If automatic updates are available, configure your antivirus to use them.
4. Keep your permanent antivirus protection enabled at all times.

Detect and Removal Instruction for Other Worms - 'B':