bropia worm spreading

rhysh · Post by **rhysh** » 31 Aug 2007, 07:40

ok guys my friend has run the bropia worm on my comp so dont accept files that come as this message

http:/xx/imageshack.m5t.de/KateHottie.zip This girl said she likes you..(L) here is her picture. Do you know her?

it is a worm
i believe its the bropia worm

anyways hope this helps
you see someone sent it to him and he ran it
so you know its on the loose cus he had it to,got it from some one else who had it too and it goes on

rhysh · Post by **rhysh** » 31 Aug 2007, 09:39

update

ok,i dont think this is the bropia
anyway this is its methods and details

renames the infected computer to noob
once msn is started and logged in it spreads by hijacking the mouse and then uses copy and paste the message with the containing link to online contacts
it also seems to copy itself onto the network
process name:img2184.jpg-www.imageshack.com
this is easily removed

block all internet traffic
start taskmanager and kill: img2184.jpg-www.imageshack.com
its listed in processes
now delete the file
scan your computer and remove the traces from your network
sorry i cant give a good details list but i only know so much about it so far

Nerdz · Post by **Nerdz** » 31 Aug 2007, 17:52

Kaspersky Anti-Virus 6.0

The requested URL http:/xx/imageshack.m5t.de/KateHottie.zip is forbidden

rambo · Post by **rambo** » 31 Aug 2007, 19:16

I got the same one last night, i showed you it.. anyway its pretty obvious not to go to a image file in the extension of a .zip..

Theres been alot've these going around lately there getting quite annoying

rhysh · Post by **rhysh** » 31 Aug 2007, 22:08

its easily prevented.
go to the start of url and take out the download file link
if its a trojan it usaully the website denies access on homepage but not downloads
also if it was a pic why was it .com executable file
it should be something like this,.jpg,flv,jpeg,png,bmp(rare to get bmp and png for photos ,
also the image should be bigger than 50 kb,try at lest 250kb -2 MB

rhysh · Post by **rhysh** » 01 Sep 2007, 08:05

more updates
ok i went to go restart my computer and it appears that this worm also removes your shut down button,i dont think this is bropia,but something simular
will update again soon,otherwise lock this topic if you dont want me to