New worm thrives on IE’s vulnerability

SAN FRANCISCO: Anti-virus companies warned computer users about a new worm that opens up a backdoor in the computers and logs keystrokes. The Bugbear worm takes advantage of a known vulnerability in Microsoft Corp.'s Internet Explorer, said Vincent Gullotto, vice president of the anti-virus response team at Network Associates Inc.

It shuts down anti-virus and firewall software designed to block out intruders and can spread by dropping copies of itself into folders on shared networks, which are commonly used at corporations and large organizations, he said. A bug in the code is believed to be keeping it from spreading by sending itself to people listed in e-mail address books, according to Gullotto. It is ranked a "medium" risk, he added.

The subject line, name of the attachment and text in the body of the message can vary, and the attachment name typically has a double extension, such as ".doc.pif," the company said. The worm, which was seen in the United Kingdom, Poland, Finland, India and the United States, seems to have leveled off, Gullotto said.

MessageLabs, a UK-based e-mail outsourcing provider, said it had seen 1,200 copies of the worm and that the first copy it received was from Malaysia.

© Reuters