Bugbear worm wants your credit card details

A new mass-mailer virus designed to seize credit card information and passwords has surfaced in the US overnight and poses a threat to users in the rest of the world.

Also known as Tanatos, Bugbear is an internet worm with a Trojan horse that first attacks anti-virus software and firewalls, then attempts to steal your passwords and credit card information. Users of Internet Explorer 5.01 or 5.5 who have not patched the Incorrect Mime header flaw have been warned they may be vulnerable to the worm's email attack.

According to Allan Bell, a Network Associates marketing director, this new worm is thought to have originated in Malaysia and is like a combination of other recent viruses, such as Funlove, Badtrans and Klez.

"It uses open file shares - like funlove, drops a keylogger - like badtrans, and is a mass-mailer - like klez," Bell said.

While the worm's spread caused alarm initially, numbers of new infections dropped quickly and it is currently the third most prevalent virus as measured by Network Associates.

"What is interesting about Bugbear is that it tries to turn off your anti-virus software or firewall, and then inserts a keylogger which captures your key strokes as you type and sends them to a TCP/IP port," Bell said. "The other interesting thing is that is uses a lot of random subject names, so just keep an eye out for unsolicited mail with strange subject lines."

The key logging Trojan horse is contained in an .exe file, so organisations and individuals which block such attachments should be safe from infection, however, for others the first sign they are infected may be the calls they receive from others complaining of strangely worded emails.

All versions of Windows are vulnerable to this worm's ability to arrive via open file sharing. Users of Macintosh, Linux, and Unix are not at risk. Since Bugbear sends infected email and contains a potentially dangerous Trojan horse, it represents a mid-level threat to most corporates.

See Bugbear - How it works http://www.silicon.com/a55761 .