Zotob Worm Hits CNN and Goes Global

securitas writes "The Zotob MS05-039 worm mentioned on Slashdot last Sunday may be the most recent virus that has gone global, hitting Windows 2000 desktops at CNN, ABC, the New York Times, and many others. The virus is spreading around the world rapidly as compromised systems become bots and propagate the worm, with reported outbreaks in Germany and China. InformationWeek has a decent article titled Zotob Proves Patching "Window" Non-Existent. Microsoft calls it a "low impact" threat and tells you What you should know about Zotob. Symantec has W32.Zotob.D removal instructions. Trend Micro thinks that this is a new, different worm altogether and says it is one of the fastest-spreading infections in history."

Comments

Is your computer infected?

[ackthpt]

• If computer is Apple, No
• If OS is Linux, No
• If OS is Windows variant, Could be
• If OS is Windows 2000, Could be
• If Search finds Botzor.exe in your filesystem, Definitely
  • What do I do?
  • Ignore it, like millions of others.

Re:Is your computer infected?

[Anonymous Coward]

If OS is Windows variant, Could be

According to TFA's apparently not.

This just in: Windows 2000 is a variant of Windows. Pictures at 11.

Re:Is your computer infected?

[Anonymous Coward]

You seem to have left a few out.

If OS is Windows 95, No
If OS is Windows 98, No
If OS is Windows ME, No
If OS is Windows XP, No
If OS is up to date with security patches, no

Or just to make it easier
If ((OS != Windows 2000)&&(System.HasAllTheSecurityUpdates != True))
Then Could be.

Re:Is your computer infected?

[Haydn Fenton]

"Ignore it, like millions of others."

Well, generally speaking it looks like that's not really a bad thing to do in this case. Check out the Symantec Security Response page (link in TFSummary), all it appears to do is remove spyware applications from the filesystem and their startup keys in the registry. Oh noes!!11!one!!
"gray-hat" worm?

Re:Is your computer infected?

[bryhhh]

Actually it is possible for XP (and Server 2003) systems to get hit by this if the following value has been set in the registry,

    HKLM\System\CurrentControlSet\Control\LSA\Restrict AnonymousSam = 0

There are some applications that will set this value at install time, so don't be confident you wont get hit because you are running Windows XP.

SANS/ISC's take on the CNN infection

[Kelson]

The Internet Storm Center's take on this is also interesting. As far as they can tell, the infection at the three news outlets is more-or-less isolated:

Speculating: The fact that CNN, ABC and the NYTimes got it may be as simple as reporters from these organizations visiting the same event and connecting to an infected network. While a firewall may have protected their office network up to now, these infected laptops where able to take out the network from the inside once they connected back to it.

Re:SANS/ISC's take on the CNN infection

[Jeremiah Cornelius]

Appalling security for these folks. Bucket-brigade virus infections. Now you know how to take one of these orgs out - drop a nasty on the lobby jacks.

Re:SANS/ISC's take on the CNN infection

[Jeremiah Cornelius]

Your ideas intrigue me, sir, and I would like to subscribe to your newsletter.

MS says..

[Turn-X Alphonse]

It doesn't effect Windows XP, so Microsoft will just go "You should of updated". Which will lead to more sales of XP by the masses beliving they need the latest OS to "be safe".

Re:MS says..

[Anonymous Coward]

Well it's true, isn't it?

I don't run vulnerable versions of the Linux kernel either, do you?

Re:MS says..

[DrEldarion]

so Microsoft will just go "You should of updated". ... and then the grammar nazis will descend upon them like hawks.

Re:MS says..

[(startx)]

I don't run vulnerable version of the Linux kernel, but then again I don't have to pay to upgrade either.

Re:MS says..

[cnettel]

It requires authentication, though. So, if you are not wide-open for file sharing through SMB or something, you will need to be infected by a machine that already has login credentials for some machine. So, it's remote privilege elevation on XP, but not form an anonymous user, making the threat much lower. Until that trsuted, unpatched 2000 machine enters the LAN.

Re:MS says..

[DrCode]

Also, you don't have to upgrade everything, either.

Re:MS says..

[Tony Hoyle]

Except if 'simple' (aka. broken) file sharing is enabled, as it is on XP Home, it'll let anyone in as guest. It's implemented at the NTLM auth level.. as I've found to my cost with SSPI based applications (the workaroud is to check the registry for the setting and warn the user they disabled their security...).

Re:MS says..

[GeoffP]

"grammar nazis"

Heil Webster!

All of a sudden

[inode_buddha]

All of a sudden, a worm makes mainstream news because it invaded CNN's network. I guess that is a sad indicator of what it takes to raise awareness.

Re:All of a sudden

[qyiet]

It could have done us all a favor, and infected Fox's network.

Re:All of a sudden

[fdiskne1]

I was in the process of testing the latest patches and was planning on expanding them out to the rest of the couple of thousand machines later in this week. I heard about the exploits available online when I woke up Sunday morning. I worked on Sunday making sure the couple of thousand machines we have were patched. By the time I was done, two viruses taking advantage of the vulnerability were in the wild so I got the signatures updated in case any machines were missed by the auto update I started. Today as I was about to leave, someone up the chain of command (not in a direct line of management with IT, thankfully) with no IT knowledge called, nearly in a panic. "My mother just called and CNN is calling this one of the worst viruses ever." I figured, "Yeah, she read a virus hoax email." She conference me in with her mother so I could hear what CNN was saying. I have never heard so much hype over such a minor virus before. From what I heard, it sounded like they were way over the top. I calmly explained to them the process I went through and when. CNN is reporting it two days later. I know this is a new version, but jeeze. Haven't these companies learned from previous virus events? I'm glad I stopped watching major media news.

A sober second opinion...

[Saint Aardvark]

... from the ever-excellent Inhttp://isc.sans.orgternetstorm/ Center:

Likely this is an isolated event, which became newsworthy because CNN got infected. We do not see any new threats at this point. Zotob keeps mutating and finding new victims. As seen with prior TCP worms, it is reaching its peak around 3 days after the outbreak.

As reported by Slashdot t'other day, they raised their threat level from Green to Yellow. They explain why they moved back to Green:

We moved to 'Yellow' on Friday, after we did see a number of exploits released for last weeks Microsoft Windows vulnerabilities, in particular MS05-039 (PnP) which is exploitable remotely.

As expected, we did see various bots, in particular 'Zotob' take advantage of this vulnerability. At this point, the situation is however static. New bot variations keep getting developed, but they do not add any fundamental new variation of the exploit. We expect that most exploitable systems have been compromised at this point.

[....] Yes, the Internet is still "broken", but it was never working all that well to begin with. The Infocon is intended to measure change. We can't stay on yellow for ever.

Instant karma's gonna get you

[Kafka_Canada]

hitting Windows 2000 desktops at CNN, ABC, the New York Times, and many others.

Hm, must be a Karl Rove plant.

Or else it's just another victory in the GWOT?

Of course this is more important than...

[craznar]

160 dead in Venezuela Crash, Gaza Pull out and Paul Abdul's Idol issues.

I doubt it - yet it's front page on CNN.COM...

I wonder...

[pointguy]

... how many computers Apple will sell because of this?

Re:I wonder...

[TykeClone]

About 1000...

Those wild and crazy mac rioters

Payload

[Teclis]

"Gives a remote attacker full control over the compromised computer to perform various actions, including:

Downloading and executing files
Making queries to www.google.com ..."

Making queries to google? Sounds like a very round-about way to search google. What is the purpose of this?

Re:Payload

[Dr. Zowie]

Jeez, the lengths some people will go to, to avoid the google cookie...

Apple user says...

[tfcdesign]

What virus?

Symantec link is wrong

[Penguinshit]

The executable in this particular instance is "wintbp.exe". I thought at first it might be a randomly-named executable, but all 100+ systems I'm manually disinfecting at the moment have the same executable. It tries to connect to other systems via port 445, aka the "Magic Windoze Port"(tm).

Apparently all it's doing is rebooting systems, but I haven't done any kind of a postmortem so don't know. I haven't detected any other connection attempts either inside or outside.

Manual disinfection means disconnecting your NIC and then using regedit to delete this value:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr ent Version\Run\wintbp.exe

You must then reboot the machine to disable the executable which is:

C:\%systemroot%\System32\wintbp.exe.

Good luck. I'm glad my own systems are Linux....

Re:Symantec link is wrong

[nvrrobx]

Check out http://securityresponse.symantec.com/avcenter/venc /data/w32.zotob.d.html to see exactly what this is attempting to do.

Re:Impact

[flowerHercules]

The Caterpillar plant I work at was down for over 16 hours, I doubt they would consider it low impact in light of the profit lost, as a result. Maybe they will switch to Linux.

Then again, they don't hire people based on their qualifications, multiplying any estimated repair time by ~10 and you come close to the actual down-time time in our facility.

I have to ask

[js3]

why a company like CNN and ABC with billions of dollars in revenue is still running unpatched windows 2000 computers.

I think the reason.....

[commo1]

Microsoft is calling this threat "low-impact" or "moderate" is that they consider Windows 2000 to be a second-tier operating system at this point and that everyone (and I mean everyone and his dog or penguin) should be using XP. Good points made above for the "variant" aspect of this virus. I'm running XP on a customer's machine (that's my cop-out, anyway), and it's got botzor.exe in the registry.

Re:AOL Call Centers

[Anonymous Crowhead]

I work in an AOL call center and we run Windows 2000. We are taking almost no calls and almost all of our computers are down.

I'm glad you found one of the few that is working so you could post to Slashdot.

CNN, ABC, the New York Times

[Nom du Keyboard]

So it has hit CNN, ABC, the New York Times. Obviously this worm is part of the Vast Right-Wing Conspiracy!

We need to re-think patching.

[cperciva]

We need to re-think we way we apply security patches. The patches for this problem were available several days ago; why weren't they applied?

The answer is that Microsoft security patches have a reputation for causing things to break. Why this happens, I don't know -- Microsoft certainly has the resources necessary to test their patches before releasing them -- but for whatever reason, patches from Microsoft have developed that reputation. As a result, administrators of large networks have learned to not apply security patches immediately to all systems, but instead to test them on a few machines for some time first -- exactly the same way as other patches are handled.

The decreasing window between patch publication and widely distributed exploit code means that this approach simply doesn't work any more. Security patches must be applied to all affected systems immediately. Don't stop to test them; just apply the patches and reboot if necessary.

Of course, this means that vendors need to do a good job of testing security fixes before releasing them. I'm proud of the fact that in my time on the FreeBSD security team, we have never released a security patch which has caused new problems. While we don't officially recommend this, I know several people who have their systems automatically download and install FreeBSD security patches -- because they trust us to make sure that our security patches will never break anything.

After all... if you can't trust the security team of the operating system you're running, why are you running that operating system?

Is it just me...

[rootedgimp]

Or does it seem like this new worm proves that there is a digital advertising war going on? Bear with me a second...

Previously (well, like early-mid 90s) when a site got hacked or a virus was running rampant, there was usually some sort of political message along with it, like a US Gov website getting hacked by a mexican / chinese hacker group that would deface the main index.html to say 'oh these people are doing some bad shit, now we're going to tell you what it is since they wont'
Notice you don't see that anymore? Like, ever? The new world of commonly noticed 'hackers' seems to be a world of mostly spyware / virus infections targeted at data mining and reselling the information gathered to advertisers. Now, with that in mind, from Symantec's description of what the worm does, look at the following:

9. Deletes the following registry values:
"Windows PNP Server" "Windows PNP" "csm Win Updates" "MyWebSearch" "WINDOWS SYSTEM" "Zotob" "MyWay" "WeatherOnTray" "Apropos" "IBIS TB" "TBPS" "Toolbar" "Hotbar" "CMESys" "NavExcel" "ViewMgr" "eZula" "EbatesMoeMoneyMaker" "Ebates" "AutoUpdater" "Gator" "Trickler" "QuickTime" "GatorDownloader" "eZmmod" "Viewpoint" "TkBellExe" "180" "WinTools" "Real" "QuickTime Task" "sais" "msbb" "saie" "180ax" "lgbibsn" "tov"

from the following subkeys: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Run HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\RunO nce

10. Searches for the following files and folders to delete the files and the contents of folders:
* %SYSTEM%\pnpsrv.exe
* %SYSTEM%\winpnp.exe
* %SYSTEM%\csm.exe
* %SYSTEM%\botzor.exe
* %PROGRAMFILES%\MyWebSearch
* %PROGRAMFILES%\MyWebSearch\*.exe
* %PROGRAMFILES%\Hotbar
* %PROGRAMFILES%\Hotbar\*.exe
* %PROGRAMFILES%\MyWay
* %PROGRAMFILES%\MyWay\*.exe
* %PROGRAMFILES%\180Solutions
* %PROGRAMFILES%\180Solutions\*.exe
* %PROGRAMFILES%\Common Files\WinTools
* %PROGRAMFILES%\Common Files\WinTools\*.exe
* %PROGRAMFILES%\Toolbar
* %PROGRAMFILES%\Toolbar\*.exe
* %PROGRAMFILES%\CxtPls
* %PROGRAMFILES%\NavExcel
* %PROGRAMFILES%\AutoUpdate
* %PROGRAMFILES%\AutoUpdate\AutoUpdate.exe
* %PROGRAMFILES%\EbatesMoeMoneyMaker
* %PROGRAMFILES%\eZula
* %PROGRAMFILES%\eZula\mmod.exe
* %PROGRAMFILES%\Common Files\GMT
* %PROGRAMFILES%\Common Files\GMT\GMT.exe
* %PROGRAMFILES%\CommonFiles\CMEII

Ever heard of a virus removing spyware for you? What reasons can we think of for a worm to do this? The one that comes to my mind seems far fetched, but assume that the spyware being removed by this virus was engineered by competitors to whoever made this virus. So maybe now we will see turf battles over drone zombified boxen? What other reasons can the /. community present for this virus removing spyware?

SBC

[Widowwolf]

Well all i can tell you is SBC is down(thats right the phone company SBC)...company wide!(Cingular is not down at this moment)

Fastest spreading ever? Probably not.

[Gary W. Longsine]

There are other possible infection vectors, but that one is most likely. Corporations would never expose Windows systems directly on the internet, but they buy laptops by the truckload, allow users to take them anywhere, then bring them back into the office and hook them up as though they were not any different than your nice safely-protected behind the firewall chained to the desktop system -- as though they hadn't been handed over to organized crime for a few days, for example. It's really not rational, but it's almost universal practice.

ABC News on the worm
"CNN, breaking into regular programming, reported on air that personal computers running Windows 2000 at the cable news network were affected by a worm that caused them to restart repeatedly."

We have seen this at a government client this week. It appears that the worm authors didn't test on Windows 2000 SP3. Several variants cause the target system to reboot when they attempt to exploit the MS05-039 defect on systems older than Windows 2000 SP4, apparently without infecting the target. The issue could be more subtle than that, perhaps systems running a particular hotfix or something like that, but I haven't had a chance to dig deeper on this point.

People tend to panic when all the PCs around them are crashing every few minutes instead of every few hours or days like normal (depending on patch level and usage pattern). The first assumption they tend to make is that the crashing computers were infected, but in this case that doesn't seem to be happening. A different worm on a different day, of course, might very well crash them after a successful infection, rather than before, so best not to get too cozy because of a small bit of luck.

It hasn't received much publicity, but if you're a network administrator battling this problem, you may have trouble patching your systems because they crash too quickly. You might want to disable NULL sessions on the Windows 2000 systems which haven't been patched yet. It appears that this will prevent an infection of an unpatched Windows 2000 system, allowing you more time to patch. (Patches being larger and the systems not staying up long enough to distribute a large package and whatnot.) I haven't yet been able to determine if the UPnP vulnerability could be exploited with NULL sessions disabled, but apparently the current crop of worms and bots all rely on it.

Notebooks and viruses at my work

[acomj]

Where I work, we have classes. And the instructor takes his notebook out and hooks into the network, pulls his powerpoint. During the class a window pops up... Oh, he says, its just a virus, it pops up from time to time, and procedes to reboot and keep going.

After class the computer goes back in the bag for a month, as he has a desktop in his office. The virus hibernates....

Our IT folks must love this..

HAH! Looks like it cleans out spyware!

[doormat]

Zotob might be what most people need to clean up their spyware.....

# Searches for the following files and folders to delete the files and the contents of folders:
  * %SYSTEM%\pnpsrv.exe
  * %SYSTEM%\winpnp.exe
  * %SYSTEM%\csm.exe
  * %SYSTEM%\botzor.exe
  * %PROGRAMFILES%\MyWebSearch
  * %PROGRAMFILES%\MyWebSearch\*.exe
  * %PROGRAMFILES%\Hotbar
  * %PROGRAMFILES%\Hotbar\*.exe
  * %PROGRAMFILES%\MyWay
  * %PROGRAMFILES%\MyWay\*.exe
  * %PROGRAMFILES%\180Solutions
  * %PROGRAMFILES%\180Solutions\*.exe
  * %PROGRAMFILES%\Common Files\WinTools
  * %PROGRAMFILES%\Common Files\WinTools\*.exe
  * %PROGRAMFILES%\Toolbar
  * %PROGRAMFILES%\Toolbar\*.exe
  * %PROGRAMFILES%\CxtPls
  * %PROGRAMFILES%\NavExcel
  * %PROGRAMFILES%\AutoUpdate
  * %PROGRAMFILES%\AutoUpdate\AutoUpdate.exe
  * %PROGRAMFILES%\EbatesMoeMoneyMaker
  * %PROGRAMFILES%\eZula
  * %PROGRAMFILES%\eZula\mmod.exe
  * %PROGRAMFILES%\Common Files\GMT
  * %PROGRAMFILES%\Common Files\GMT\GMT.exe
  * %PROGRAMFILES%\Common Files\CMEII

the real news story is

[Indy1]

Major media corp IT depts badly behind in patching their systems, news at 11!

Honestly Zotob is a joke. I work IT for a major university thats 95% win 2k and xp, and so far we've had 0 zotob infections. I wouldnt be surprised if we eventually got 1 or 2 here and there with old boxes that arent tied into the domain, but the vast majority of the workstations auto update themselves and hence this is a non issue for any properly run network.

LATE BREAKING NEWS on CNN Right Now

[mexicangeek]

"CNN's network admins suck."

MS authored?

[saddino]

So, MS, who desperately wants the 50% or so of entrenched businesses still on 2000 to upgrade, claims this worm is "low impact" hmm?

Clearly, MS is implying the solution is to upgrade to XP. From their site: If you are using any supported version of Windows other than Windows 2000, you are not at risk from Zotob and its variants.

How convenient! Really, why do I think the first answer to Bill's brainstorming marketing session on "How do we get people to move off 2000?" was some smart-ass saying "Well, we could always write a virus or worm for it."

After all, any notion of "irreperable harm" from security threats has vanished in the onslaught on the Windows hegemony. One little, "not so bad" worm wouldn't really hurt the Windows reputation any more than it already has been, and it sure would be a nice kick-in-the-pants for those businesses sitting on the 2000 fence.

Just saying^H^H^H^H^H^Hpostulating.

Removes spyware?

[gargan]

Has anyone else noticed that according to the Symantec security response page, this virus removes several common spyware files? kills process, removes registry entry, and deletes. I suppose it does this so that it will have the machine's internet connection mostly to itself, but I find that fascinating.

Re:Removes spyware?

[mabu]

It makes perfect sense.

All these worms are written by spammers who want to turn the machines into zombied SMTP servers. They want to disable other exploitive processes.

If all major ISPs filtered port 25 traffic (like AOL does) from anyplace other than their in-house SMTP gateways, you'd see worm activity drop to almost nothing. It's all about spamming. And the feds don't seem to care. Sooner or later, the major broadband providers will act responsibly and stop their clients from becoming spam zombies, then there won't be much of a need for these worms to be released. That's what they're all about: spamming.

Really good advice

[interstellar_donkey]

From Microsoft's info page:

Customers who believe they have been attacked should contact their local FBI office or post their complaint on the Internet Fraud Complaint Center Web site.

Ummm...

"Hello, FBI? Yeah, hi. This is Pat. Listen, I've noticed my computer has been running a little slow lately. Yeah, more so then usual... Well, I heard about this new worm virus on the news... Yeah, I know I should run a virus scanner... Yes, I'm aware that the FBI does not troubleshoot and provide support for PCs... No, I don't expect you to launch a huge investigation because I suspect I *might* have been infected... Of course I'm aware that even if I was infected, there's really nothing the FBI can do about my particular case. . . . What do you mean 'Why am I calling you'?? Microsoft said I should!!"