BugBear

[LarrySmith]

Taken from http://www.siliconvalley.com/mld/sil...gy/4301328.htm



FAQ | Removing worm with special tool
By John J. Fried
Inquirer Columnist


Question: When I try to install Norton 2002 AntiVirus, I get an error message that a script error has occurred. A second message asks if I want to continue running scripts. If I click on Yes, the computer goes into a hang-up loop. If on No, I get: "Are you sure you want to exit? Your computer is not protected." This happens at the point where the installation process wants to run LiveUpdate to get new virus definitions.

- wfbuie@verizon.net
A: One possibility is that you have been infected by the Bugbear worm, a new form of malicious code sweeping the world.

Because Bugbear was designed to circumvent antivirus programs as well as firewalls, you have to download a special tool to remove it.

Because you are using Norton AntiVirus, you should get Symantec's Bugbear tool (at http://securityresponse.symantec.com). Readers using other antivirus programs should check the Web sites for their programs.

In some instances, the scripting error may be the result of a problem in Internet Explorer, which LiveUpdate uses to reach the Symantec site for the newest virus definitions.

Symantec has posted some instructions for dealing with that situation (see www.symantec.com/search). In the Web site's Search window, type "script AND error AND install" without the quotes.

Put a check mark in the box next to Knowledge Base, and click on Search.

The article "Error: 'Internet Explorer Script Error..' in Line: 323 when stepping through the..." is the one you want.

Q: The hard drive on my Compaq Presario is getting old, and I want to replace it. However, the Presario came without any CDs for the operating system and other programs on the computer. How do I move everything to the new drive?

- cat1cat@comcast.net
A: I am really tempted to precede my advice with a lecture on how your experience provides one more reason to follow that timeless FAQ dictum:

"Never buy a computer that doesn't come with a separate CD for every program, especially Windows, that's already set up on the hard drive."

But I won't.

Install your new hard drive and, following the instructions in the accompanying manual, set it to be the secondary, or slave, drive.

Buy a program such as PowerQuest's Drive Image and install it on your old drive. Use Drive Image to create an exact copy of your old drive on your new drive.

Reset your new drive to be the master, or primary, drive.

If you do not want to keep your old drive, yank it. If you want to keep the old drive to use as a second storage device, reset it to be the slave drive.

Unless you got a drive manual with the computer, you will have to ask Compaq about the correct setting.

A caveat: Use the image-creation software carefully. If you do not and your new drive is larger than the original drive, you may not be able to use all of the space available on your new drive after the image has been created.

You may want to consult PowerQuest tech support before you start. Tell them that your new drive is bigger and that you want to preserve its full storage capability.

Another option is Alohabob, a program designed to move system configurations from an old computer to a new one. However, it will also work drive-to-drive.

As with Drive Image, you will have to first install your drive as a secondary drive, then change its status to primary drive.

On the Web

www.alohabob.com/products.asp

Q: When updating Windows or downloading security patches, should I first disable GoBack, update, and then re-enable it?

- mvendick@comcast.net
A: The idea behind GoBack and its Microsoft cousin, Windows Restore, is that they let you return your computer to an earlier time.

This comes in handy if you have installed a program or driver that somehow corrupted your configuration. It comes in especially handy when using Microsoft Critical Updates, which have been known to mess up things.

To be able to do their magic, these time-machine programs should be left on at all times.

[oofki]

I am a tech at a small computer store and i have seen this one about 100 times...And you arent going to like how to fix it...NAV 2002 was actually horrible and that happens a lot...It either can conflict with your current version of office if you have office installed or some where along the line something messed up something in the registry...I and no one i work with know how to fix it except blowing away the system im not sure if there is another way...sry but all you can really do is....FDISK.

[nihil]

Oh Dear What Can The Matter Be?

I fail to see why Larry's report of an article on a (rather old hat) malware gets approbation, and oofki's reasonably sensible comment gets negged

If someone had bothered to POST their feelings I might understand.

Please talk to me...I am starting to feel lonely

Cheers

[rapier57]

Gee, nihil, you want this to all make sense?

I haven't yet figured out the motivation behind these posts.

[Und3ertak3r]

me thinks that some are slightly pissed at the resurecting of a year old thread.. not good for ones karma..

Advice: Old threads.. let sleeping dogs lie...
..

Also good to Quote the text in question.. as the original post coverd several topics.. perhaps a jab at the original poster.. just Quote applicable text..

As for oofki's post.. ALL bugbear removals I have performed on winxp and NAV2002(approx 150 of).. were clean and did not require a repartition/format/Install.. only prob I had was with Win98 and WinMe.. to save time A clean install was done in those cases.. not I said to save time.. that is.. I only allocate 30mins to a virus removal.. if I run out of time it is a clean install..

Cheers

[LarrySmith]

Edited by LarrySmith because he overreacted to a simple mistake.

******* mode=off


Why don't you PM him and ask who negged him as well as the reason given?

Moderater can we PLEASE close this thread? It is surely a dead dog now.

Rodney King:

"why can't be all just GET along?" ::

[nihil]

Profuse apologies Larry,

I did not spot that you were referring to the "original" BugBear

Cheers

[c0bra]

what v of bugbear is this bugbear b???

[LarrySmith]

That was part of the confusion Cobra.
My solution deals with the original version. I think ooki tried to apply it to a more recent varient and it ddin't work.
The date from my original post was a year ago. 10/20/2002
I want the Mods to close this thread because the solution posted isn't workable for the more recent varient. At least that's the impression I get from oofki's post.

[c0bra]

if you want to delete is thread you can, by going to the top post clicking edit then tick the box and click delete