Bangkok--Aug 16--Core & Peak
WORM_ZOTOB.A took advantage of newly announced Microsoft security flaw
The global network antivirus and internet content security expert Trend
Micro today warned internet users of WORM_ZOTOB.A, the memory-resident worm which
takes advantage of Microsoft Plug-and-Play security flaw (Microsoft Security
Bulletin MS05-039 published on 9th August 2005. WORM_ZOTOB.A infects Windows 95,
98, ME, NE, 2000 and XP platforms and has backdoor capability, enabling hackers
a remote access to affected systems.
What makes WORM_ZOTOB so notable is its exploit of Microsoft security
hole is believed to be the fastest in the history of malware creation: it was
speedily released just 4 ~ 5 days after the announcement of the new vulnerability
(please see table 1):
WORM Vulnarability Date of Issued Exploit of Worm Timeframe of Window
Zotob MS 05-039 9th August 2005 13th August /2005 5 days
Sasser MS 04-011 13th April /2004 1st May 2004 18 days
Blaster MS 03-026 16th July 2003 11th August /2003 26 days
Slammer MS 02-039 24th July 2002 25th January 2003 183 days
Nimda MS 00-078 17th October 2000 18th September 2001 336 days
Table 1.Timeframe of window between MS Security flaw and exploit by
malicious code
Upon execution, WORM_ZOTOB.A drops a copy of itself into the Windows
system folder as BOTZOR.EXE. What makes it dangerous is that it modifies the
system's HOSTS file in the infected user’s computer so as to prevent the user
from get online assistance from certain antivirus Web sites. It even added the
following lines in an attempt to threaten antivirus companies:
Botzor2005 Made By .... Greetz to good friend Coder. Based On HellBot3
MSG to avs: the first av who detect this worm will be the first killed
in the next 24hours!!!
The backdoor capabilities of ZOTOB enable it to connect to a specific
Internet Relay Chat (IRC) server and allow hacker a remote control over affected
system, which can then be used to infect other unpatched machines in network, slow
down the network performance, and put private and enterprise data into great danger
of exposure to malicious user.
Hundred of infection reports were sighted in U.S and Germany. Since
most users may not be aware of this newly announced security hole so as to install
the necessary patch during last weekend, we can foresee more infections from
WORM_ZOTOB in APAC and other regions.
At the point of this writing, the WORM_ZOTOB.B variant has already been
unleashed in the wild.
Trend Micro urges all enterprises and personal users to update their
anti-virus pattern files and apply the latest Microsoft patches immediately so as
to protect their digital assets from harm by this family of malicious software.
For more information please contact:
Srisuput Siangyen
PR Consultant
Core & Peak Co., Ltd.
Tel: 02 439-4600 ext. 8300
[email protected] End.