Signature Detail

WORM: Bugbear B Worm Propagation

This signature detects attempts by the Bugbear B worm to propagate using Samba or unsecured Windows file shares. Bugbear B creates a backdoor on port 1080 of an infected Microsoft Windows host. Attackers can use this backdoor to take control of the host.

Extended Description

Bugbear is a worm that targets various Microsoft Windows operating systems. It uses the Microsoft Internet Explorer Incorrect MIME Header Vulnerability to launch itself when a user reads or previews an infected e-mail message. It opens a backdoor, and acts as a key logger on the victim machine. It propagates through e-mail.

References

• URL: http://www.sophos.com/virusinfo/analyses/w32bugbearb.html
• URL: http://www.microsoft.com/technet/security/bulletin/MS03-020.mspx
• URL: http://www.ealaddin.com/home/csrt/valerts2.asp?virus_no=11494&cf=tl