W32/Zotob.I Worm

 Information about the W32/Zotob.I Worm:

W32/Zotob.I is a worm. This worm is a variant of W32/Zotob.A. The worm will infect Windows 2000 systems which are not updated with MS05-039 vulnerability patch released by Microsoft. The worm cannot infect Windows Me/98/95/XP/NT computers until and unless the infected file is executed manually in the local computer.

This worm exploits PnP vulnerability present in Windows as explained by Microsoft Security Bulletin MS05-039 on TCP Port 445.

Upon execution, the worm copies itself as hpsv.exe in the Windows System folder.

It modifies the Windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

It also creates a mutex called S-Y-B-O-T-By-Sky-Dancer to check the presence of the worm in the system memory.

The worm creates a remote access to an IRC Server through TCP port 5544 then downloads and executes the infected file.

The worm also creates ftp server and randomly scans for the computers with this flaw on the network. If found then the worm creates a remote access through TCP 445 and sends a script file 2pac.txt to the victim computer. This script file will download the worm file haha.exe from the infected computer and executes the same in the victim's computer.

Microsoft has released the patch for the MS05-039 vulnerability. It can be downloaded from the following link:

http://www.microsoft.com/technet/security/bulletin/MS05-039.mspx

Users should apply the patch downloaded from the links provided above to remove the vulnerabilities inherent in the system.

This worm first appeared on August 20, 2005.

 Other names of W32/Zotob.I Worm:

This Worm is also known as W32.Zotob.I, WORM_ZOTOB.I .