Zotob Worm Hits CNN and Goes Global

securitas writes "The Zotob MS05-039 worm mentioned on Slashdot last Sunday may be the most recent virus that has gone global, hitting Windows 2000 desktops at CNN, ABC, the New York Times, and many others. The virus is spreading around the world rapidly as compromised systems become bots and propagate the worm, with reported outbreaks in Germany and China. InformationWeek has a decent article titled Zotob Proves Patching "Window" Non-Existent. Microsoft calls it a "low impact" threat and tells you What you should know about Zotob. Symantec has W32.Zotob.D removal instructions. Trend Micro thinks that this is a new, different worm altogether and says it is one of the fastest-spreading infections in history."

Comments

I wonder...

[pointguy]

... how many computers Apple will sell because of this?

I think the reason.....

[commo1]

Microsoft is calling this threat "low-impact" or "moderate" is that they consider Windows 2000 to be a second-tier operating system at this point and that everyone (and I mean everyone and his dog or penguin) should be using XP. Good points made above for the "variant" aspect of this virus. I'm running XP on a customer's machine (that's my cop-out, anyway), and it's got botzor.exe in the registry.

Re:Is your computer infected?

[Haydn Fenton]

"Ignore it, like millions of others."

Well, generally speaking it looks like that's not really a bad thing to do in this case. Check out the Symantec Security Response page (link in TFSummary), all it appears to do is remove spyware applications from the filesystem and their startup keys in the registry. Oh noes!!11!one!!
"gray-hat" worm?

Is it just me...

[rootedgimp]

Or does it seem like this new worm proves that there is a digital advertising war going on? Bear with me a second...

Previously (well, like early-mid 90s) when a site got hacked or a virus was running rampant, there was usually some sort of political message along with it, like a US Gov website getting hacked by a mexican / chinese hacker group that would deface the main index.html to say 'oh these people are doing some bad shit, now we're going to tell you what it is since they wont'
Notice you don't see that anymore? Like, ever? The new world of commonly noticed 'hackers' seems to be a world of mostly spyware / virus infections targeted at data mining and reselling the information gathered to advertisers. Now, with that in mind, from Symantec's description of what the worm does, look at the following:

9. Deletes the following registry values:
"Windows PNP Server" "Windows PNP" "csm Win Updates" "MyWebSearch" "WINDOWS SYSTEM" "Zotob" "MyWay" "WeatherOnTray" "Apropos" "IBIS TB" "TBPS" "Toolbar" "Hotbar" "CMESys" "NavExcel" "ViewMgr" "eZula" "EbatesMoeMoneyMaker" "Ebates" "AutoUpdater" "Gator" "Trickler" "QuickTime" "GatorDownloader" "eZmmod" "Viewpoint" "TkBellExe" "180" "WinTools" "Real" "QuickTime Task" "sais" "msbb" "saie" "180ax" "lgbibsn" "tov"

from the following subkeys: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Run HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\RunO nce

10. Searches for the following files and folders to delete the files and the contents of folders:
* %SYSTEM%\pnpsrv.exe
* %SYSTEM%\winpnp.exe
* %SYSTEM%\csm.exe
* %SYSTEM%\botzor.exe
* %PROGRAMFILES%\MyWebSearch
* %PROGRAMFILES%\MyWebSearch\*.exe
* %PROGRAMFILES%\Hotbar
* %PROGRAMFILES%\Hotbar\*.exe
* %PROGRAMFILES%\MyWay
* %PROGRAMFILES%\MyWay\*.exe
* %PROGRAMFILES%\180Solutions
* %PROGRAMFILES%\180Solutions\*.exe
* %PROGRAMFILES%\Common Files\WinTools
* %PROGRAMFILES%\Common Files\WinTools\*.exe
* %PROGRAMFILES%\Toolbar
* %PROGRAMFILES%\Toolbar\*.exe
* %PROGRAMFILES%\CxtPls
* %PROGRAMFILES%\NavExcel
* %PROGRAMFILES%\AutoUpdate
* %PROGRAMFILES%\AutoUpdate\AutoUpdate.exe
* %PROGRAMFILES%\EbatesMoeMoneyMaker
* %PROGRAMFILES%\eZula
* %PROGRAMFILES%\eZula\mmod.exe
* %PROGRAMFILES%\Common Files\GMT
* %PROGRAMFILES%\Common Files\GMT\GMT.exe
* %PROGRAMFILES%\CommonFiles\CMEII

Ever heard of a virus removing spyware for you? What reasons can we think of for a worm to do this? The one that comes to my mind seems far fetched, but assume that the spyware being removed by this virus was engineered by competitors to whoever made this virus. So maybe now we will see turf battles over drone zombified boxen? What other reasons can the /. community present for this virus removing spyware?

SBC

[Widowwolf]

Well all i can tell you is SBC is down(thats right the phone company SBC)...company wide!(Cingular is not down at this moment)

HAH! Looks like it cleans out spyware!

[doormat]

Zotob might be what most people need to clean up their spyware.....

# Searches for the following files and folders to delete the files and the contents of folders:
  * %SYSTEM%\pnpsrv.exe
  * %SYSTEM%\winpnp.exe
  * %SYSTEM%\csm.exe
  * %SYSTEM%\botzor.exe
  * %PROGRAMFILES%\MyWebSearch
  * %PROGRAMFILES%\MyWebSearch\*.exe
  * %PROGRAMFILES%\Hotbar
  * %PROGRAMFILES%\Hotbar\*.exe
  * %PROGRAMFILES%\MyWay
  * %PROGRAMFILES%\MyWay\*.exe
  * %PROGRAMFILES%\180Solutions
  * %PROGRAMFILES%\180Solutions\*.exe
  * %PROGRAMFILES%\Common Files\WinTools
  * %PROGRAMFILES%\Common Files\WinTools\*.exe
  * %PROGRAMFILES%\Toolbar
  * %PROGRAMFILES%\Toolbar\*.exe
  * %PROGRAMFILES%\CxtPls
  * %PROGRAMFILES%\NavExcel
  * %PROGRAMFILES%\AutoUpdate
  * %PROGRAMFILES%\AutoUpdate\AutoUpdate.exe
  * %PROGRAMFILES%\EbatesMoeMoneyMaker
  * %PROGRAMFILES%\eZula
  * %PROGRAMFILES%\eZula\mmod.exe
  * %PROGRAMFILES%\Common Files\GMT
  * %PROGRAMFILES%\Common Files\GMT\GMT.exe
  * %PROGRAMFILES%\Common Files\CMEII

Removes spyware?

[gargan]

Has anyone else noticed that according to the Symantec security response page, this virus removes several common spyware files? kills process, removes registry entry, and deletes. I suppose it does this so that it will have the machine's internet connection mostly to itself, but I find that fascinating.