WORM_BIBROG.E is a memory-resident worm that propagates via email and via peer-to-peer (P2P) file-sharing networks, such as Kazaa and Morpheus. It affects computers running Windows 95, 98, ME, NT, 2000, and XP. This worm displays a shooting game with the window title "La Cacademia." Upon execution, this worm drops a copy of itself in the Windows directory as "MANZANA.EXE." It also drops a copy of itself in the Windows system folder as "ACADEMIA.EXE." It drops the following copies in the Windows StartUp folder: ITCH.EXE ITCJ.EXE These files are executed at every Windows startup. This worm drops copies of itself as "Kylie_Minogue_screensaver.exe" and "Shakira_screensaver.exe" in the following shared folders of P2P file-sharing applications: KaZaaMy shared Folder ICQShared GroksterMy Grokster MorpheusMy Shared Folder When either ITCH.EXE or ITCJ.EXE is executed, it sends the following email (using its own SMTP engine) with itself as an attachment to all addresses in the Windows Address Book: Subject: Fwd: La Academia Azteca Message body: La cacademia azteca (muy bueno) ¡no es virus! Attachment: academia.exe If you would like to scan your computer for WORM_BIBROG.E or thousands of other worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's free, online virus scanner at: http://housecall.trendmicro.com WORM_BIBROG.E is detected and cleaned by Trend Micro pattern file #495 and above.