New windows worm knocking out computers

lord_neo · Aug 19, 2005

As of August 16, 2005 5:12 PM (Pacific Daylight Time; GMT-7:00), TrendLabs has declared a Medium Risk Virus Alert to control the spread of WORM_ZOTOB.D and WORM_RBOT.CBQ. TrendLabs has received several infection reports indicating that this malware is spreading in Brazil and the U.S.A.

WORM_ZOTOB.D is a memory-resident worm that drops a copy of itself in the %System%\wbev folder as WINDRG32.EXE.

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 95, 98, and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP.)

It takes advantage of the Microsoft Windows Plug and Play vulnerability to propagate across networks. For more information regarding this vulnerability, refer to the Microsoft Security Bulletin MS05-039 found in the following Web page:

https://www.microsoft.com/technet/security/bulletin/ms05-039.mspx

(Note: This propagation routine works only on NT-based systems (Windows NT, 2000, XP, and Server 2003), because the Microsoft Windows Plug and Play vulnerability exists only on these platforms.)

It also has backdoor capabilities, and may execute commands coming from a remote malicious user. This provides remote users virtual control over affected systems, thus compromising system security.

As a form of an anti-debugging technique, this worm also gathers Web sites from RSS feeds, then randomly sends these sites as messages in the IRC channel it is connected to. It does this in order to confuse or mislead anyone who is monitoring the IRC channel from the real IRC commands it issues.

================

WORM_RBOT.CBQ is a memory-resident worm that drops a copy of itself in the Windows system folder as WINTBP.EXE.

This worm also takes advantage of the Microsoft Windows Plug and Play vulnerability to propagate across networks. This propagation routine works only on Windows NT and 2000, as the Microsoft Windows Plug and Play vulnerability exists only on these platforms.

This worm also connects to an IRC server, joins a specific channel and then sends the following messages:

• {Random} :ER DL FH
• {Random} :ER DL IF
Click to expand...

https://news.com.com/Windows+worm+knocking+out+computers/2100-7349_3-5835530.html

born2tab · Aug 19, 2005

hey neo,
thatz an important piece of information and i would term it timely.For the past few days the network in our firm got clogged and for no reasons the network was showing heavy traffic.
And we have all windows based systems.
Now u showed me the way..Pbly its related to this attack or..may be not.
Anyway brilliant piece of info.
keep it up.
U keep all of us well informed
:nw:

ssslayer · Aug 19, 2005

wow ... hacker-gang-warfare

lord_neo · Aug 19, 2005

Glad i could help! Which antivirus is your network on? :think:

Addy Pant · Aug 20, 2005

Yeah, Neo is the No. 1 info-giver!

nik_bokacheley · Aug 20, 2005

:think:..I had some kind of problem few days ago... My dial-up seep went down like hell..I wasn't able to open a single page..:...Might be becoz of this...

Anyway how to fight this viruses??..Norton will do??

Pe@Ce 0uT!!

Addy Pant · Aug 20, 2005

Thank God I'm using Windows XP!
@Neo: That Computer Forum Leadership competition; is it over now??

lord_neo · Aug 20, 2005

Nope still on...

Log in or Sign up

New windows worm knocking out computers

lord_neo Guest

born2tab rhythm guitarist

ssslayer Banned

lord_neo Guest

Addy Pant Highway Star

nik_bokacheley :help: I'm a mad :sadbye:

Addy Pant Highway Star

lord_neo Guest

Share This Page

Log in or Sign up

New windows worm knocking out computers

lord_neo Guest

born2tab rhythm guitarist

ssslayer Banned

lord_neo Guest

Addy Pant Highway Star

nik_bokacheley :help: I'm a mad :sadbye:

Addy Pant Highway Star

lord_neo Guest

Share This Page

Useful Searches