Yesterday Symantec reported 800 submissions of the Bugbear worm, the latest reports are of over 3,000 infections across the globe, with around 350 coming from Australia, according to David Banes, regional manager of Symantec security response.
Due to the level of infections, Symantec has increased the threat level of Bugbear (also known as Tanat, Tanatos, WORM_NATOSTA.A, and W32/Bugbear@MM) to Category 4, "Very Serious", a level shared by uber-worms Klez and Nimda.
Due to the steady growth of Bugbear it is being compared to Klez, although security experts say it will be a few weeks before they know how serious the worm will prove to be.
"It doesn't look set to be an explosive pandemic like Nimda was," Paul Ducklin, head of global support for Sophos Anti-virus told ZDNet Australia. "Which is good, but it's also bad because it doesn't get the zest to stamp it out that Nimda did. With Klez, it started steadily and continued steadily. Let's hope that doesn't happen here."
One of the problems with fighting Bugbear is that it shuts down many popular antivirus programs, so a computer can seem to get a clean bill of health because the scan stopped halfway through, according to Ducklin. For this reason the Sydney office of Sophos has developed a free fix, which deactivates the virus automatically before identifying and removing infected files. It's about 70 K in size.
The other worm discovered on Monday, Opaserv, doesn't appear to be as major a threat, as it doesn't seem to spread actively. "It doesn't generate e-mails, it just spreads on the network," said Ducklin. "Its goal was to be present and to be around, as a Trojan."
He compared it to the Qaz worm, which gained notoriety by infecting Microsoft.
Incredibly Inaccurate Title & Byline! (Symantec's fault?)
But maybe that is primarily Symantec's Fault?
"Australia ranks high in Bugbear infections"
Australians are more susceptible to Bugbear than to most worms, with 11.7 percent of reported infections coming from this country.
These figures show nothing of the sort! They show that we are more likely to detect other computers *attempting* to infect our machines.
They are not "reported infections", but "attempted infections", or maybe "detected infection attempts". An altogether much better thing to have (Our office has had zero infections, but has blocked 50 attempts so far this week(not using Symantec!) ).
But it would be interesting to know how many businesses actually *did* get infected!