Bropia.F Spreads via MSN Messenger

WORM_Bropia.F attempts to send copies of itself in different filenames to all online contacts, pretending to be alluring images -- what users get is a comical photo of a roasted chicken with a bikini tan line. The worm also bears the AGOBOT worm as part of its payload, capable of opening backdoor on infected systems. Sightings of the worm have been reported in Taiwan, China, Korea, and the U.S.





Upon execution, the memory-resident WORM_BROPIA.F drops a copy of itself in the Windows system folder, and then tries to propagate to other MSN Messenger users by sending a copy of itself under one of these filenames:

• Bedroom-thongs.pif
  
• Hot.pif
  
• LMAO.pif
  
• LOL.scr
  
• Naked_drunk.pif
  
• New_webcam.pif
  
• ROFL.pif
  
• Underware. Pif
  
• Webcam.pif

The worm also executes a file called SEXY.JPG, which displays a photo of a chicken that appears to have cooked in the oven with its bathing suit on.

Once it has infected a system, WORM_BROPIA.F also drops a bot program that Trend Micro detects as WORM_AGOBOT.AJC, which drops a backdoor into the infected system, and may allow commands to be executed from a remote malicious user. WORM_AGOBOT.AJC can also steal the Windows Product ID, as well as the CD keys of certain applications.

WORM_BROPIA.F arrives in a file about 184 KB in size. It affects Windows 95, 98, ME, NT, 2000 and XP platforms.

Source: press release

See also:

Bropia.A to Target IM Networks

Bagle.BK and Bagle.BL are Breading at an Enormous Rate

Bin Laden Terrorist Video Email is Really a Virus





Permalink: Bropia.F Spreads via MSN Messenger

---

Posted 02/03/05 | Filed under: Security |

Technorati tags: Bropia, Spreads, MSN, Messenger, roasted, chicken, bikini, tan