Discussion in 'malware problems & news' started by Randy_Bell, Mar 29, 2003.

Thread Status:
Not open for further replies.
  1. Randy_Bell

    Randy_Bell Registered Member

    May 24, 2002
    Santa Clara, CA
    WORM_BIBROG.E is a memory-resident worm that propagates via email and via peer-to-peer (P2P) file-sharing networks, such as Kazaa and Morpheus. It affects computers running Windows 95, 98, ME, NT, 2000, and XP. This worm displays a shooting game with the window title "La Cacademia."

    Upon execution, this worm drops a copy of itself in the Windows directory as "MANZANA.EXE." It also drops a copy of itself in the Windows system folder as "ACADEMIA.EXE."

    It drops the following copies in the Windows StartUp folder:

    • ITCH.EXE
    These files are executed at every Windows startup.

    This worm drops copies of itself as "Kylie_Minogue_screensaver.exe" and "Shakira_screensaver.exe" in the following shared folders of P2P file-sharing applications:

    • KaZaaMy shared Folder
      GroksterMy Grokster
      MorpheusMy Shared Folder
    When either ITCH.EXE or ITCJ.EXE is executed, it sends the following email (using its own SMTP engine) with itself as an attachment to all addresses in the Windows Address Book:

    Subject: Fwd: La Academia Azteca
    Message body: La cacademia azteca (muy bueno) ¡no es virus!
    Attachment: academia.exe

    If you would like to scan your computer for WORM_BIBROG.E or thousands of other worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's free, online virus scanner at: http://housecall.trendmicro.com

    WORM_BIBROG.E is detected and cleaned by Trend Micro pattern file #495 and above.
Thread Status:
Not open for further replies.