WORM_BIBROG.E

Discussion in 'malware problems & news' started by Randy_Bell, Mar 29, 2003.

Thread Status:
Not open for further replies.
  1. Randy_Bell

    Randy_Bell Registered Member

    Joined:
    May 24, 2002
    Posts:
    3,004
    Location:
    Santa Clara, CA
    WORM_BIBROG.E is a memory-resident worm that propagates via email and via peer-to-peer (P2P) file-sharing networks, such as Kazaa and Morpheus. It affects computers running Windows 95, 98, ME, NT, 2000, and XP. This worm displays a shooting game with the window title "La Cacademia."

    Upon execution, this worm drops a copy of itself in the Windows directory as "MANZANA.EXE." It also drops a copy of itself in the Windows system folder as "ACADEMIA.EXE."

    It drops the following copies in the Windows StartUp folder:

    • ITCH.EXE
      ITCJ.EXE
    These files are executed at every Windows startup.

    This worm drops copies of itself as "Kylie_Minogue_screensaver.exe" and "Shakira_screensaver.exe" in the following shared folders of P2P file-sharing applications:

    • KaZaaMy shared Folder
      ICQShared
      GroksterMy Grokster
      MorpheusMy Shared Folder
    When either ITCH.EXE or ITCJ.EXE is executed, it sends the following email (using its own SMTP engine) with itself as an attachment to all addresses in the Windows Address Book:

    Subject: Fwd: La Academia Azteca
    Message body: La cacademia azteca (muy bueno) ¡no es virus!
    Attachment: academia.exe

    If you would like to scan your computer for WORM_BIBROG.E or thousands of other worms, viruses, Trojans and malicious code, visit HouseCall, Trend Micro's free, online virus scanner at: http://housecall.trendmicro.com

    WORM_BIBROG.E is detected and cleaned by Trend Micro pattern file #495 and above.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.