Description
This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Indication of Infection
The worm also attempts to disable CMD.EXE, TASKMGR.EXE, and the ability to use the RIGHT-CLICK of the mouse, and the CTRL-ALT-DELETE key combination.
It installs (drops) a new W32/Gaobot.worm variant to C:\oms.exe (119,296 bytes)
The worm copies itself to the root directory of the root drive, using one of the aforementioned filenames. It does not otherwise install itself on the system (it does not create any registry or other startup hooking locations).
Methods of Infection
This worm attempts to spread via MSN Messenger.
Aliases
W32.Bropia (Symantec), Win32.Bropia.A (CA)