Bugbear side effect hits printers

Bugbear infections look to be levelling off slowly, but the worm's faulty code is having an unexpected side effect.

Antivirus companies Sophos and Network Associates have both reported a slow down in infection detection, but overall the worm will top the threat charts for this month.

However, a bug in the worm has meant that networked printers are being affected. In some cases the first a company has known about the infection is when the machines start spewing out pages of gibberish.

"Most virus writers aren't geniuses and this one is no exception," said Graham Cluley of Sophos.

"A fault in the code means that the virus identifies network printers as potential hosts and sends code to them.

"The printer then tries to print the code in binary format, which comes out as gibberish. It doesn't harm the printers but the stationary costs are an added annoyance."

Bugbear disables antivirus and firewall software and installs a Trojan keystroke logger as a DLL, detected as PWS-Hooker.dll.

Anything the PC user types via the keyboard, such as passwords or sensitive information, is sent to the originator of the worm via the TCP port 36794.

The worm also seeks to infect all other PCs on the network via the address book and network shares.

It also takes advantage of a longstanding Microsoft exploit, MS-01/020, as did Klez. A patch for this has been available since March 2001 and can be found here.

Sophos has made a free Bugbear removal tool available here that will work with any PC.