What is Bropia worm?
The Bropia worm is a type of malware that spreads via instant messaging (IM) by sending infected attachments to IM users. This worm uses MSN Instant Messenger to send infected files and spreads by sending them through the IM contact list. The Bropia worm is similar to the Kelvir worm, except that it sends an infected file directly to users, while the Kelvir worm sends a link pointing to an infected file.
Bropia worm is also known as Bropia.A, IM-Wurm.Win32.VB.a, W32 / Bropia-A, Win32.Bropia.a and WORM_BROPIA.F.
When it runs, the Bropia worm copies itself to the Windows system folder with different filenames. The filename will likely be winhost.exe, updates.exe, or lexplore.exe, although new versions use different filenames. Changes are then made to the RUN area of the registry in order to be loaded automatically. It also leaves a variant of Spybot worm on the infected machine. This variant of Spybot then connects to the Internet Relay Chat (IRC) channel, giving the worm full access to the computer. With this backdoor option, a hacker could steal data from an infected system.
After the worm runs, it may display an image and disable the computer's right mouse button so that the user cannot access context sensitive menus. The worm copies itself to the C drive of the computer and monitors changes in the IM contacts there. To avoid this and other worms, IM users should install updated antivirus software and avoid clicking suspicious links in instant messages.