W32/Opanki Worm!MS06-040

 Information about the W32/Opanki Worm!MS06-040:

W32/Opanki is a worm. The worm will infect Windows systems and spreads through shared network, MIRC chat client and AOL Messenger.

It also spreads through computers which are vulnerable to the Server Service Remote Buffer Overflow as explained by Microsoft Security Bulletin MS06-040 and older vulnerabilities including Buffer Overflow in the Workstation Service Could Allow Code Execution as explained by Microsoft Security Bulletin MS03-049.

Upon execution, the trojan copies itself as lsass.exe in the Windows folder and rdriv.sys in the Windows System folder. These two files are registered as services.

It alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

The worm also lowers Windows Security settings by altering the windows registry at the following locations;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windowsfirewall\Standardprofile\ Enablefirewall

It also prevents updates from installing Windows XP Service Pack 2.

The worm opens a backdoor at TCP port 443 and tries to connect the following IRC server;

bla.girlsontheblock.com

After the connection is established, it listens for commands coming from a remote malicious user.

Microsoft has released a patch for Microsoft Windows Server Service Could Allow Remote Code Execution Vulnerability. It can be downloaded from the following link;

http://www.microsoft.com/technet/security/bulletin/MS06-040.mspx

You can check your system for other Windows Vulnerabilities using the Protector Plus - Windows Vulnerability Scanner. It guides you to update with the right patch to make your system secure.

You can download and learn more about Protector Plus - Windows Vulnerability Scanner at the following location:

http://www.protectorplus.com/download/winvulscan.htm

This worm first appeared on August 31, 2006.

 Other names of W32/Opanki Worm!MS06-040:

This Worm is also known as Backdoor.Win32.Rbot.ayg, WORM_RBOT.AEY, W32/Opanki.worm!MS06-040.