To remove the Bugbear worm from a system, it's enough to delete all its files from a hard drive and to restart a computer.
If the worm is in a network environment, the network should be temporarily taken down and all systems have to be disinfected separately. Otherwise the worm will try to re-infect already cleaned systems.

Disinfection Tool

F-Secure provides the special tool to disinfect Bugbear worm. The tool and disinfection instructions are available on our ftp site:
Note

After disinfection it is recommended to change all log-in credentials, as they could have been compromised by the password stealer component of the worm. It is also recommended to check infected systems and networks for possible hacker intrusion that could have been performed through the backdoor component of the worm.

More details about the removing procedure you can find in our support center: http://www.f-secure.com/support/technical/av5/support-issue-2002100200.htm

Backdoor:W32/Bugbear.K is an e-mail and network worm that also has a backdoor component. This particular variant is very similar to the original Tanatos worm that was found in 2002.
Bugbear is also known as Tanatos.

Propagation
This Tanatos worm variant spreads in e-mail messages with the following characteristics:
Subjects:

Body text:

Attachment names:

Detection

F-Secure Anti-Virus detects Bugbear/Tanatos worm with the following update:

[FSAV_Database_Version]
Version=2006-01-24_03