Bugbear, to avoid outbound filtering and other restrictions on mail volume, uses its own SMTP implementation. Thus Bugbear benefits from disabling antivirus programs (which are starting to use heuristics to stop such things) and personal firewall programs (which are specifically designed to stop such things).

Stopping antivirus programs is a benefit for a worm like Bugbear, as it counters behavior blocking and similar restrictions which the antivirus vendors may include. Thus it is not a "stupid" trick, but a sensible trick for a worm to halt AV programs.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/116/16804#16804