Bube - a true baddie

[bcastner]

This just appeared from nowhere. If you are current with the MS Antispyware freeware it can remove this one. Otherwise, additional instructions and a discussion of how bad a bad boy this guy is:

http://www.broadbandreports.com/forum/remark,12688162~mode=flat~days=9999

Note that this disables the XP firewall, System Restore, and corrupts Explorer.exe, so the steps outlined avove seem reasonable if you discover a case of a sudden lose of all desktop icons.

Best wishes,
Bill Castner

 

[bcastner]

I count threads in various forums of Tek-tips at 4 showing Bube.D issues as of this morning.

Really be on the lookout for this bad guy.

 

[diogenes10]

I think I have to remove this from my son's system. I had not studied through Calamity Jane's fix yet. The MS antispyware is an alternative to that?



-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[bcastner]

With current definitions, yes.

 

[zarkon4]

What exploit does it use? I have been trying to find this on symantecs site but found no info. Any other links that define this one, as far as what it does?

 

[LloydSev]

http://securityresponse.symantec.com/avcenter/venc/data/downloader.admincash.html

That is a Symantec posting about the Bube family.

And supposedly Panda does detect and fix the infection without removing or quarantining explorer.exe

Computer/Network Technician
CCNA

 

[aquias]

Interesting tidbit I found on a different site

"I just had to sort out a Windows 98 PC infected with this. It produced another symptom too. You can install and run old versions of Grisoft AVG 7.0 free edition (e.g. 300a419), but if you either update AVG over the internet or install a later version in the first place (e.g. the current download which is 300a456), then when the PC reboots at the end of ths installation, it gives the message "Error loading explorer.exe. You must reinstall Windows." Rebooting to safe mode and uninstallng AVG allows the PC to boot again.

If anyone else gets this syptom, I suggest using SFC to restore c:\windows\explorer.exe from the install CD. BTW the date on the modified explorer.exe is not recent, it looks as old as the installation, otherwise I would have spotted it earlier. I eventualy dicovered that the PC had this virus by installing AVG in customised mode, turning off Resident Shield and doing a full scan. AVG Free now detects this virus (it didn't 24 hours ago), however on seeing AVG detect a virus in Explorer.exe I immediately stopped the scan before AVG could quarantine or delete it. "

This thread is a much shorter replica, beyond the above, of the Broadbandreports thread.
Click me

Nice bit of information there Bill!