New Bugbear Variant Spreading Fast

Bugbear-B is a mass-mailing worm similar to the original Bugbear virus that spread widely last fall, according to antivirus supplier Sophos. But the new version is polymorphic, meaning that it changes its appearance to avoid detection, the company said.

The worm carries random subject lines and messages and appears to use words or file names taken from infected systems, according to the Avert response team at McAfee Security, a Network Associates unit. Avert raised the threat level of Bugbear-B to high from medium-on-watch Thursday morning.

Bugbear-B, which surfaced Wednesday, also spreads through network shares, installs a keystroke logger and may try to disable security software.

MessageLabs, a managed e-mail security services provider, issued a high-level alert for enterprises because of the worm's rapid spread and potential for damage. The company said it had intercepted more than 35,000 copies of the virus across 106 countries by Thursday morning.