WORM_BIBROG.E

WORM_BIBROG.E is a memory-resident worm that propagates via email and via peer-to-peer (P2P) file-sharing networks, such as Kazaa and Morpheus. It affects computers running Windows 95, 98, ME, NT, 2000, and XP. This worm displays a shooting game with the window title "La Cacademia."

Upon execution, this worm drops a copy of itself in the Windows directory as "MANZANA.EXE." It also drops a copy of itself in the Windows system folder as "ACADEMIA.EXE."

It drops the following copies in the Windows StartUp folder:

• 
  ITCH.EXE
  ITCJ.EXE

These files are executed at every Windows startup.

This worm drops copies of itself as "Kylie_Minogue_screensaver.exe" and "Shakira_screensaver.exe" in the following shared folders of P2P file-sharing applications:

• 
  KaZaaMy shared Folder
  ICQShared
  GroksterMy Grokster
  MorpheusMy Shared Folder

When either ITCH.EXE or ITCJ.EXE is executed, it sends the following email (using its own SMTP engine) with itself as an attachment to all addresses in the Windows Address Book:

Subject: Fwd: La Academia Azteca
Message body: La cacademia azteca (muy bueno) ¡no es virus!
Attachment: academia.exe

If you would like to scan your computer for WORM_BIBROG.E or thousands of other worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's free, online virus scanner at: http://housecall.trendmicro.com

WORM_BIBROG.E is detected and cleaned by Trend Micro pattern file #495 and above.