From Trend Micro
Like the earlier BROPIA variants, this memory-resident worm spreads
copies of itself via MSN messenger, a popular instant messaging
application, using attractive file names.
This worm arrives as a Win32 .EXE file. Upon execution, this
non-encrypted, memory-resident worm drops another file which Trend
Micro detects as WORM_RBOT.AOR.
The dropped file can have the filename WINIS.EXE. Its attributes
are set to hidden, system and read-only. After dropping,
WORM_BROPIA.S executes this file.
It drops a JPEG picture file in the root folder, which is usually
C:\. It opens the image with Internet Explorer (IE). The following
is a sample of the dropped image file:
http://www.trendmicro.com/vinfo/images/WORM_BROPIA_S_img1.gif
It also sets the attributes of this dropped file to read-only,
hidden and system to avoid easy detection. After dropping, it
executes this file and terminates itself.
The worm propagates using MSN Messenger, a popular chat program. It
sends its copy to all contacts found in the MSN Messenger
application.
It arrives via MSN Messenger with a message that contains the
following details:
(message)(link)
======================================================
(message) can be any of the following:
CHECK THIS LOL!
CUSTOM
Huge Turd hahaah! :-P
LOOK! :-O
nice! :-P
ownage! 
paris hilton got hacked!! 
(link) can be any of the following:
http://members.chello.nl/a.sinnema1/FUNNY-SHIT!.pif
http://members.chello.nl/a.sinnema1/scary.pif
http://members.chello.nl/a.sinnema1/sexy-bitch.pif
http://members.chello.nl/h.keuth/massive-turd.pif
http://members.chello.nl/h.keuth/paris-hilton.pif
http://members.chello.nl/h.keuth/w00t!.pif
Since it's being detected as an Rbot, it will be deemed as
dangerous.
Rbot is a backdoor trojan, meaning it will open your computer to
attacks by hackers. The recommended solution is to reformat, to
prevent loss of sensitive information.
Also, it is to save you from getting you into trouble with laws.
This trojan can connect you to some dubious websites and launch
attacks against websites, known as DDoS, which is illegal.
