W32/Scob.A Trojan

 Information about the W32/Scob.A Trojan:

W32/Scob.A is a trojan. This trojan will infect Windows NT/2000/2003 web servers. The trojan exploits Remote Code Execution vulnerability present in Windows as explained by Microsoft Security Bulletin MS04-013.

The trojan code will be in the infected pages. On accessing this infected page, the trojan searches for the cookie file which contains the string trk716 in the accessed computer. If the cookie file is not found the trojan tries to download a file dot.php from the following location;

http://217.10<un-available>.218.147

After this, the trojan creates a cookie file with the name trk716 in the victim's computer.

Microsoft has released a patch for this MS04-013 vulnerability. It can be downloaded from the following link:

http://www.microsoft.com/technet/security/bulletin/ms04-013.mspx

Users should apply the patch downloaded from the link provided above to remove the vulnerability inherent in the system.

This trojan first appeared on June 25, 2004.

 Other names of W32/Scob.A Trojan:

This trojan is also known as JS_SCOB.A, JS/Scob-A, Scob.