W32.bugbear.B.Dam

Iam helping a friend who got a virus and he thinks its w32.bugbear.b.dam

When you try 2 open norton antivirus it just shut it down after like 5 sekunds so we have problems with removing it.

The virus is here: "c:\windows\all users\menuen start\programmer\start\Iyyq.exe" (danish windows 98)

the file size is 73.728byte

I have tryed 2 delete the file from dos and then it's gone.
but when i try 2 update norton antivirus (connect to the internet with 56k) then it came back
after like 40 sekunds and shut antivirus down again.

Any idea how 2 fix the virus ?

Quote:

---

sorry 4 my bad english

---

Use the bugbear removal tool, and then if your av doesn't work after that... reinstall it.

http://securityresponse.symantec.com...oval.tool.html

It is also possible that its a different virus thats causing the problem.
Are you sure its the bugbear virus? What makes you think this?

Hes friend got a mail from him and the antivirus took it and he sayd that it was bugbear.b.dam

There you go then. Follow the instructions in the link I provided above.

Let us know if it fixes the problem.

Oh, by the way... welcome to AO!

thanx ;) Nice place by the way..
Ill go 2 my friend tonight or tomorrow..

ill write back after that :)

Hi De@thBloW,

There seems to be something strange here?................I got an e-mail with this virus, and my PC-Cillin intercepted and quarantined it. McAfee did not spot it at all, but it seems to me that PC-Cillin is a more "agressive" product, as McAfee did get there in the end :) I had a look at it, and it didn't do anything :)

My real concern is that your virus has been identified as bugbear.b.dam As far as I know the ".dam" is short for "damaged", and the virus should not work. Just like my one didn't.

I would go with Phishphreek80's suspicion that you might have another virus as well?

You could try an online scanner from one of the other AV suppliers to get a second opinion........Trend Micro is one company that does one.

You might also check what is running (ctrl+alt+delete) and close anything that you don't need/recognise, check your start menu, then try to update your Norton again.

Just a thought

Ey. I just fixed the problem.
I was reading obout all the types of bugbears and i found out that Bugbear.B@mm were closing antivirus programs.

I tryed 2 download the bugbear.B@mm remover execute it but nothing happend..

I restarted the computer into safe mode and tryed again and BANG: 6 viruses found.

Now the antivirus works again and is fully updated so all problems are gone..


Thanx 4 your all's support.

nihil....

No 2 anti-virus products catch the same virus (at the same time). I got infected with a 'backdoor' rsbot trojan. Panda AV missed it; Pc-cillin missed it.; Norton online caught it.

It is a habit that I scan with at least 3 different AV products.

Prolly something to do with how & when they update.

Panda is daily updates
Symantec is 'posted' weekly for auto update. (I run manual updates in between)
Mcafee is 'posted' weekly for auto update (also run manually between postings.)

Dcongram.......I agree, and use several if I don't get a result. I agree on the update timing, I also think that it has something to do with the core search engine and the architecture?

Well at least he got there :D

Cheers

BTW I have written a couple of "tutorials" in which I point to a number of other secondary defences you might like to try out?