Custom Search
Join the PC homebuilding revolution! Read the all-new, FREE 200-page online guide: How to Build Your Own PC!
NOTE: Using robot software to mass-download the site degrades the server and is prohibited. See here for more.
Find The PC Guide helpful? Please consider a donation to The PC Guide Tip Jar. Visa/MC/Paypal accepted.
Results 1 to 16 of 16

Thread: Bugbear virus

  1. #1
    Join Date
    Feb 2002
    Location
    Pointe claire que canada
    Posts
    255

    Bugbear virus

    BrrrrrrrrMy system got infected with the W32 Bugbear Virus.As a result,I lost the following: c:\windows\system\VAMC.exe
    Iran Norton but could not repair the file so I put it in quarantine.
    Where can I get this file from? I have win98.Thanks

  2. #2
    Join Date
    Aug 2001
    Location
    Stanley NC
    Posts
    3,950
    seems it's an execution file you need to know what it is associated with?? What program does it belong to??
    Want my weapons molon labe

  3. #3
    Join Date
    Feb 2002
    Location
    Pointe claire que canada
    Posts
    255
    I don't know what program it is associated with.

  4. #4
    Join Date
    Nov 2000
    Location
    The Mountain State
    Posts
    23,359
    Have you run any Bugbear cleaners?

    Sophos disinfection instructions

    Nod32 BugBear cleaner

    I could not find any info on that file either.......
    AV, Anti-Trojan List;Browser and Email client List;Popup Killer List;Portable Apps
    “When men yield up the privilege of thinking, the last shadow of liberty quits the horizon.” - Thomas Paine
    Remember: Amateurs built the ark; professionals built the Titantic."

  5. #5
    Join Date
    Jul 2002
    Location
    Minn
    Posts
    17,373
    How do you know this file is missing. If you are getting an error message, post that here since it may give clues on where it came from and what to do with it.

    Budfred

  6. #6
    Join Date
    Mar 2002
    Location
    Bath, UK
    Posts
    39

    bugbear

    Hi,

    I've just been infected by this worm. It apparently creates an exe file of it's own (variably named)..are you sure this is not such a file?
    See: http://securityresponse.symantec.com...ugbear@mm.html
    I've used three different removal tools, including Symantecs', and my comp is now apparently clean.

    K.

  7. #7
    Join Date
    Oct 2001
    Location
    N of the S of Ireland
    Posts
    20,504
    Unless it has mutated, Bugbear is not destructive to files as such; its just a bitch to remove on a LAN and it slows down your system and immobilizes antiviruses.

    As Kalitechnis2 suggests that file probably WAS Bugbear, which Norton sorted-out.
    Take nice care of yourselves - Paul - ♪ -
    Help to start using BiNG. Some stuff about Boot CDs & Data Recovery Basics & Back-up using Knoppix.

  8. #8
    Join Date
    Mar 2002
    Location
    Bath, UK
    Posts
    39

    Registry setting Run Once

    I mentioned that the bubear removal tools had cleaned my system, but the Registry setting for Run Once is still there:
    Namedefault), Data:Value not set.

    Does anyone know if this is the culprit, which has not been cleaned or is it something else & in order?

    (I'm not really accustomed to delving in the (98 se) Registry)

    Any info gratefully received,

    K.

  9. #9
    Join Date
    Mar 2002
    Location
    Bath, UK
    Posts
    39
    I don't know how that smilie (glumlie?) got there..tried to edit it out but it refuses to go. It is supposed to be a colon = :

    K.

  10. #10
    Join Date
    Jul 2002
    Location
    Minn
    Posts
    17,373
    It got there because you inadvertently put in a vb code for the frown face. You have to be careful about spacing when you are using things like colons or you end up with instead of : (

    Budfred

  11. #11
    Join Date
    Oct 2001
    Location
    N of the S of Ireland
    Posts
    20,504
    Should you need to use the actual text that results in a smilie like
    :) or :( or :D
    then just edit the post by checking the box "Disable Smilies in this Post"
    Take nice care of yourselves - Paul - ♪ -
    Help to start using BiNG. Some stuff about Boot CDs & Data Recovery Basics & Back-up using Knoppix.

  12. #12
    Join Date
    Feb 2002
    Location
    Pointe claire que canada
    Posts
    255
    hi
    I got to the register key but did not see the "RunOnce" item
    what is this?Is it created by the worm?If I do not see it,does this mean the worm is out of my system?Something tells me I still have something in the computer because everytime I attempt to run a small program(ultrawipe) by clicking the exe file ,the latter won't open.But I can't seem to find what's wrong.

  13. #13
    Join Date
    Oct 2001
    Location
    N of the S of Ireland
    Posts
    20,504
    If either of you have navigated to:-
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnce

    and found that the following are shown:-
    Name: (Default) Data: (Value not set)

    That is normal and nothing has been set to run once; ie nothing is set to be executed at the next boot-up.

    If you are infected (or say being reinfected from a LAN) then The Name: and Data: would have random characters representing the name of the Bugbear File.

    If the RunOnce Key itself is missing then that should be no problem either; if you want to recreate it then feel free to do so. Just RClick on the Current Version "Folder" and select New Key; then just name/rename the key to RunOnce.

    Once the PC reboots, the runonce values are removed by the OS; ie there should only be a default key with no value remaining.
    Take nice care of yourselves - Paul - ♪ -
    Help to start using BiNG. Some stuff about Boot CDs & Data Recovery Basics & Back-up using Knoppix.

  14. #14
    Join Date
    Mar 2002
    Location
    Bath, UK
    Posts
    39

    Run Once

    Many thanks to you , Paul Komski.

    Now my mind can rest, knowing that Bugbear is completely clear of my system.

    K.

  15. #15
    Join Date
    Feb 2002
    Location
    Pointe claire que canada
    Posts
    255
    Hi

    Many thnaks to you Paul Komski.
    By the way I did run the Symantec removal tool(it did not find anything).So I am alright.Again many thanks

  16. #16

    Bugbear

    Hi,
    i got bugbear a few weeks ago from an email attachment,
    my avg virus scanner picked it up and cleaned it.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •