Name :	Backdoor:W32/Bugbear.K
Detection Names :	Email-Worm.Win32.Tanatos.k Email-Worm:W32/Bugbear.K
Category:	Malware
Type:	Backdoor
Type:	Net-Worm, Email-Worm
Platform:	W32
Date of Discovery:	April 12, 2006

A remote administration utility which bypasses normal security mechanisms to secretly control a program, computer or network.

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Eliminating a Local Network Outbreak

If the infection is in a local network, please follow the instructions on this webpage:

Note

After disinfection it is recommended to change all log-in credentials, as they could have been compromised by the password stealer component of the worm. It is also recommended to check infected systems and networks for possible hacker intrusion that could have been performed through the backdoor component of the worm.

More details about the removing procedure you can find in our support center: http://www.f-secure.com/support/technical/av5/support-issue-2002100200.htm

Backdoor:W32/Bugbear.K (also known as Tanatos) is an e-mail and network worm that also has a backdoor component. This particular variant is very similar to the original Tanatos worm that was found in 2002.

Propagation

This Tanatos worm variant spreads in e-mail messages with the following characteristics:

Subjects:

Body text:

Attachment names: