Need help? Ask the community or hire an expert.
Go to Avira Answers
Alias:W32/Bibrog@MM, W32/Bibrog.C@mm
Type:Worm 
Size:235,520, 192,512 
Origin: 
Date:00-00-0000 
Damage:Worm/Bibrog.C is a massmailer and sends itself using Microsoft Outlook to all available addresses. 
VDF Version:6.23.00.00 
Danger:Low 
Distribution:Low 

Distribution1. Uses Microsoft Outlook to send itself to all available addresses. The email looks like this:
Subject: Fwd:La Academia Azteca
Message: La cacademia azteca (muy bueno) no es virus!
Attachment: Academia.exe

Technical DetailsWhen active, the worm opens a program looking like a shooting game. It will possibly change the Windows background.

The worm generates the following actions:
1. opens a program looking like a shooting game.
2. copies itself in:
%System%\academia.exe
%WinDIR%\manzana.exe
%StartUp%\Itch.exe
%StartUp%\Itcj.exe
3. creates %WinDIR%\Mai.vbs, a 2 Byte non-virus file, which can be manually deleted.
4. tries to copy itself in the following folders:
%current directory%\KaZaA\My Shared Folder
%current directory%\Grokster\My Grokster
%current directory%\My Shared Folder
%current directory%\ICQ\shared files

with the following names:
Alessandra Ambrosia porn screen_saver.exe
Anna Kournikova porn screen_saver.exe
Britney Spears porn screen_saver.exe
Cameron Diaz porn screen_saver.exe
Charlize Theron porn screen_saver.exe
Christina Aguilera porn screen_saver.exe
Donna D'Erico porn screen_saver.exe
Halle Berry porn screen_saver.exe
Helena Christensen porn screen_saver.exe
Jenna Jameson porn screen_saver.exe
Jessica Alba porn screen_saver.exe
Karina Lombard porn screen_saver.exe
Kelly Hu porn screen_saver.exe
Kirsten Dunst porn screen_saver.exe
Kylie Minogue porn screen_saver.exe
Pamela Anderson porn screen_saver.exe
Salma Hayek porn screen_saver.exe
Sandra Bullock porn screen_saver.exe
Shakira porn screen_saver.exe
Stacey Keibler porn screen_saver.exe

After the PC is restarted:
the worm runs "Itch.exe" in the startup directory, wich performs the following actions:
1. see spreading, above.
2. creates the following files:
%WinDIR%\Osiris.bmp (54,594 Bytes)
%WinDIR%\Quiettime.bmp(327,222 / 2,942 Bytes)
3. changes the desktop background, modifying Win.ini:
[Desktop]Wallpaper=%WinDIR%quiettime.bmp or [Desktop]Wallpaper=%WinDIR%osiris.bmp
4. Creates the following files in \MyDocuments:
Acafug.htm, 7,622 Bytes
Citibank.htm, 26,212 Bytes
Hotmail.htm, 10,072 Bytes
Msn.htm, 20,611 Bytes
Yahoo.htm, 15,382 Bytes

All .html files are disguised as well-known websites, but they collect usernames and passwords and send them to the author of the Worm/Bibrog.C.
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .