Virus attempts to override computer protection

New Zealand's largest internet service provider says it is filtering thousands of emails each day containing the "bugbear" virus.

Xtra says it has so far caught about 40,000 copies of bugbear, an email worm which was first reported just three days ago.

Bugbear terminates anti-virus processes before propagating itself through users' address books. It exploits a weakness in unpatched Microsoft Internet Explorer versions 5.01 and 5.5 and the address books of Microsoft email programs Outlook and Outlook Express.

It is delivered by email messages containing no body text and a variety of subject lines including: "$150 FREE Bonus!" and "Daily Email Reminder".

Xtra spokesperson Matt Bostwick says Bugbear has doubled the number of virus-infected emails caught and cleaned by the internet service provider's anti-virus email filter.

"Over the past few weeks we've been trashing a total of between 30,000 and 40,000 email viruses of all kinds a day. But just one day after the Bugbear virus first appeared, we caught around 24,000 emails infected with the new virus alone.

"By yesterday the number of Bugbear-infected emails we caught and cleaned was up to 40,000, and that's not counting all the other variants of email viruses that our filter is trashing."

Xtra's anti-virus email filter stops most known email viruses before they can get into customers' inboxes. All Xtra customers who use an Xtra mailbox to send or receive email messages are covered by the server-based anti-virus filter.

The Bugbear virus is reported to have originated in Malaysia, and attempts to shut down anti-virus and firewall protection being run on its victims' computers.

It includes a 'Trojan horse' programme that attempts to capture information such as passwords and credit card details from a victim's computer, and send them back to the original virus writer.

The virus also contains a bug that means it attempts to copy itself to printers on a victim's network, resulting in some victims reporting printers churning out pages of unreadable code.