W32.Wargbot

W32.Wargbot is a network-aware worm that opens an IRC back door on the compromised computer. It spreads by exploiting the Microsoft Windows Server Service Remote Buffer Overflow Vulnerability (as described in Microsoft Security Bulletin MS06-040). The Trojan may download a copy of Backdoor.Ranky.X.

Note: Definitions prior to August 13, 2006 may detect this as Backdoor.IRC.bot or W32.Mocbot.B.

Protection

• Initial Rapid Release version August 13, 2006
• Latest Rapid Release version January 23, 2010 revision 021
• Initial Daily Certified version August 13, 2006
• Latest Daily Certified version January 23, 2010 revision 023
• Initial Weekly Certified release date August 16, 2006

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Medium

Distribution

• Distribution Level: High