W32/Tilebot.IC is a worm. The worm will infect Windows systems and spreads through network. It also has an IRC backdoor Trojan component.

This worm exploits LSASS, WKS, RPC-DCOM, PNP and ASN.1 vulnerabilities present in Windows as explained by Microsoft Security Bulletin MS04-011, MS03-049, MS04-012, MS05-039 and MS04-007.

Upon execution, the worm copies itself as vcmon.exe in the Windows folder. The file vcmon.exe is registered as a new system driver service named "Windows Security Manager" and a startup type of automatic, so that it is started automatically during system startup

It alters the windows registry at the following location;

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Microsoft has released the patch for MS04-011, MS03-049, MS04-012, MS05-039 and MS04-007 vulnerabilities. It can be downloaded from the following links:

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
http://www.microsoft.com/technet/security/bulletin/MS03-049.mspx
http://www.microsoft.com/technet/security/bulletin/MS04-012.mspx
http://www.microsoft.com/technet/security/bulletin/MS05-039.mspx
http://www.microsoft.com/technet/security/bulletin/MS04-007.mspx

Users should apply the patch downloaded from the link provided above to remove the vulnerabilities inherent in the system.

You can check your system for other Windows Vulnerabilities using the Protector Plus - Windows Vulnerability Scanner. It guides you to update with the right patch to make your system secure.

You can download and learn more about Protector Plus - Windows Vulnerability Scanner at the following location:

http://www.protectorplus.com/download/winvulscan.htm

This worm first appeared on December 07, 2006.

 Other names of W32/Tilebot.IC Worm:

This Worm is also known as Backdoor.Win32.SdBot.aad,WORM_SDBOT.EAI.