high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 27 February 2005 16:26:36 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Bropia-S is a worm for the Windows platform that spreads using the MSN
Messenger application.
W32/Bropia-S monitors the status of MSN Messenger and sends a copy of itself
to Messenger contacts.
W32/Bropia-S drops and runs a copy of the worm W32/Forbot-EK.
W32/Bropia-S is a worm for the Windows platform that spreads using the MSN
Messenger application.
When first run W32/Bropia-S creates and runs the following files in the current folder:
bot.exe - detected by Sophos anti-virus as W32/Bropia-S.
botz.exe - detected by Sophos anti-virus as W32/Forbot-EK.
The file botz.exe will only appear in the current folder momentarily after which the action of the W32/Forbot-EK worm will move the file to the windows system folder with the filename doit.exe.
W32/Bropia-S may display an error message that reads "Enkele bestanden konden niet gemaakt worden. Sluit alle toepassingen, start Windows opnieuw op en start deze installatie opnieuw op". A WinRAR application window will appear after the error message has been accepted.
W32/Bropia-S monitors the status of MSN Messenger and sends a copy of itself
to Messenger contacts.
|
