WORM: Bugbear B Worm Propagation

This signature detects attempts by the Bugbear B worm to propagate using Samba or unsecured Windows file shares. Bugbear B creates a backdoor on port 1080 of an infected Microsoft Windows host. Attackers can use this backdoor to take control of the host.

Extended Description

Bugbear is a worm that targets various Microsoft Windows operating systems. It uses the Microsoft Internet Explorer Incorrect MIME Header Vulnerability to launch itself when a user reads or previews an infected e-mail message. It opens a backdoor, and acts as a key logger on the victim machine. It propagates through e-mail.

References

URL: http://www.sophos.com/virusinfo/analyses/w32bugbearb.html http://www.microsoft.com/technet/security/bulletin/MS03-020.mspx http://www.ealaddin.com/home/csrt/valerts2.asp?virus_no=11494&cf=tl

Short Name

WORM:SMB:BUGBEAR-B

Severity

Major

Recommended

False

Recommended Action

Drop

WORM: Bugbear B Worm Propagation

Extended Description

References

Found a potential security threat?