Signature Detail

WORM: Bropia-F

This signature detects the Bropia-F worm, which propagates using MSN. Using the contact list of an infected user, the worm sends a "would you like to download that file" message to all contacts; when accepted by an uninfected user, the worm installs itself and a backdoor, then begins propagating using the new user's contact list.

Extended Description

W32.Bropia-F is a worm that infects Windows operating systems and propagates through MSN Messenger. It drops a variant of Rbot on an infected computer.

References

• URL: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BROPIA.F
• URL: http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=131539
• URL: http://securityresponse.symantec.com/avcenter/venc/data/w32.bropia.html