Panda Virus Alert: Zotob.A

- Panda Software reports on the new Zotob.A that exploits the
vulnerability in Plug and Play -
- Virus Alerts, by Panda Software (http://www.pandasoftware.com )​

Madrid, August 14 2005 - PandaLabs reports on a new worm, Zotob.A, that exploits the vulnerability in Plug and Play (PnP) which could allow remote code execution and elevation of privileges in the affected computer. This worm is the first to appear which exploits this security problem, only 5 days after Microsoft announced this critical security problem on its bulletin MS05-039, which also includes details of the updates that users are advised to apply.

Zotob.A scans IP addresses through port 445 in order to find vulnerable systems. If it finds one, it will send instructions to transfer itself to these computers. A has an IRC client through which it connects to a certain IRC server. In this way it can receive commands that can enable the computer to be administered remotely.

Zotob.A creates the "B-O-T-Z-O-R" mutex to prevent two copies of itself being executed simultaneously on the system. Besides, it modifies the HOSTS file to prevent access to certain web pages.

Panda Software recommends users to download the patch offered by Microsoft which appeared just some days ago. The web page to download this patch is available at: http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx

To help as many users as possible scan and disinfect their systems, Panda Software offers its free, online anti-malware solution, Panda ActiveScan, which now also detects spyware, at http://www.activescan.com. Webmasters who would like to include ActiveScan on their websites can get the HTML code, free from http://www.pandasoftware.com/partners/webmasters.

Panda Software also offers users Virus Alerts, an e-bulletin in English and Spanish that gives immediate warning of the emergence of potentially dangerous malicious code. To receive Virus Alerts just visit Panda Software's website (http://www.pandasoftware.com/about/subscriptions/) and complete the corresponding form.

More information about these and other threats is available in Panda Software's Encyclopedia at: http://www.pandasoftware.com/virus_info/encyclopedia/

 

W32.Zotob Removal Tool 1.0

http://www.klitetools.com/comments.php?catid=89&shownews=3657