The Worm - Zotob

  • Thread starter Thread starter James E. Morrow
  • Start date Start date
J

James E. Morrow

The worm Zotob is reported to be on the loose. Microsoft has opened up
its "War Rooms" and the computers of the U.S. Senate are said to be
infected. Windows 2000 boxes are said to be the only ones at any real
risk. Surprise!

Symptoms include shutdown and frequent rebooting. A patch is available
from Microsoft at www.Microsoft.com/security.

http://www.microsoft.com/security/incident/zotob.mspx


http://www.cnn.com/2005/TECH/internet/08/16/computer.worm/index.html

This message is for general information. I know the real professionals
in this group don't need to be told any of this, but it doesn't hurt to
repeat it.
 
What I wanted to know is how they got infected in the first place? Did a
user go to a website, open an attachment, or download a file via FTP?
 
you said:
What I wanted to know is
Click to expand...

This is the only thing you need to know about this worm:

Non-Affected Software:

Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE),
and Microsoft Windows Millennium Edition (ME)
 
On that special day, Colon Terminus, ([email protected])
said...
I guess no one knows exactly how this worm is contracted.
I've not seen a clear, concise explanation anywhere on the myriad of sites
I've visited.
Click to expand...

It added the PnP vulnerability exploit to various other exploits that
had already been implemented, and becaus of that spread rather fast.

But I bet if someone has a closer look, (s)he might find well known
portions in the source. Some sites said, there seemed to be weird
contest going on, where bot A tried to remove bot B, and then a bot C
came and removed bot A, in turn.

http://www.f-secure.com/weblog/


Gabriele Neukam

(e-mail address removed)
 
you know who maybe said:
What I wanted to know is how they got infected in the first place? Did a
user go to a website, open an attachment, or download a file via FTP?
Click to expand...
I read that it can be spread by email as a picture attachment.
Here is the link if you are interested:
http://www.eweek.com/article2/0,1895,1849337,00.asp

"The unusual number of news organizations hit may have been due to a Zotob
variant, Zotob.C, that spread over e-mail and disguised the worm file as a
picture attachment. One or more reporters used to receiving photos via e-mail
may have been the source of the infection, which then spread to vulnerable
machines on the corporate networks of those companies, and through stolen e-mail
contacts to other news organizations, according to an e-mail from Alan Paller,
director of research at SANS."
 
Colon said:
I guess no one knows exactly how this worm is contracted.
I've not seen a clear, concise explanation anywhere on the myriad of sites
I've visited.
Click to expand...

from the page listed above:
"The backdoor has the ability to spread to remote computers using the
PNP exploit on port 445. If the attack is successful a shell (cmd.exe)
is started on port 8594. Through the shell port, the worm sends a tftp
script which instructs the remote computer to download and execute the
worm from the attacker computer using built-in TFTP server listening on
port 69."

that seems pretty clear to me...
 
Buffalo said:
I read that it can be spread by email as a picture attachment.
Here is the link if you are interested:
http://www.eweek.com/article2/0,1895,1849337,00.asp

"The unusual number of news organizations hit may have been due to a Zotob
variant, Zotob.C, that spread over e-mail and disguised the worm file as a
picture attachment. One or more reporters used to receiving photos via e-mail
may have been the source of the infection, which then spread to vulnerable
machines on the corporate networks of those companies, and through stolen e-mail
contacts to other news organizations, according to an e-mail from Alan Paller,
director of research at SANS."
Click to expand...

Bingo!

Spreads via email. Wonder why that info was so difficult to drag outta the
information providers. All the initial reports were quite vague in this
regard leaving reader confused as to how the bug spread. Most in my circle
believed it was only spread via IRC and therefore they, as non users of
IRC, didn't need to be concerned.

Thanks for the enlightenment.
 
Colon Terminus said:
Bingo!

Spreads via email. Wonder why that info was so difficult to drag outta the
information providers. All the initial reports were quite vague in this
regard leaving reader confused as to how the bug spread. Most in my circle
believed it was only spread via IRC and therefore they, as non users of
IRC, didn't need to be concerned.

Thanks for the enlightenment.
Click to expand...

You're welcome,
Buffalo
 
Colon said:
Spreads via email. Wonder why that info was so difficult to drag outta the
information providers.
Click to expand...

Some of the info says quite explicitly that it is also able to spread
via port 445. Since most users probably don't know how to close port
445 to intruders, this is worth emphasizing.
 
Tore Lund said:
Some of the info says quite explicitly that it is also able to spread
via port 445. Since most users probably don't know how to close port
445 to intruders, this is worth emphasizing.
Click to expand...

Very true.
 
Back
Top