W32/Mocbot!MS06-040 Trojan

 Information about the W32/Mocbot!MS06-040 Trojan:

W32/Mocbot!MS06-040 is a trojan. The trojan will infect windows system and spreads through shared network and AOL Messenger.

It can also spread to computers which had vulnerable to the Server Service Remote Buffer Overflow as explained by Microsoft Security Bulletin MS06-040.

Upon execution, the trojan copies itself as wgareg.exe or wgavm.exe in the Windows system folder. These two files are registered as services.

It alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

It connects to the Internet Relay Chat (IRC) server. After the connection is established, it joins an IRC channel and listens for commands coming from a remote malicious user.

Once it successfully exploits the Server Service vulnerability, it automatically runs dropped file on the affected system. This allows the dropped trojan to perform its malicious routines on the system.

Microsoft has released a patch for Microsoft Windows Server Service Remote Buffer Overflow Vulnerability. It can be downloaded from the following link;

http://www.microsoft.com/technet/security/bulletin/MS06-040.mspx

You can check your system for other Windows Vulnerabilities using the Protector Plus - Windows Vulnerability Scanner. It guides you to update with the right patch to make your system secure.

You can download and learn more about Protector Plus - Windows Vulnerability Scanner at the following location:

http://www.pspl.com/download/winvulscan.htm

This trojan first appeared on August 14, 2006.

 Other names of W32/Mocbot!MS06-040 Trojan:

This Trojan is also known as IRC-Mocbot!MS06-040, WORM_IRCBOT.JL, W32.Wargbot, Win32/Graweg, W32/Cuebot-M.