Mytob (Zotob) Worm Alert

The latest variants of the Mytob worm use a vulnerability in the Windows Plug&Play interface to infect Windows systems. a-squared detects the worm as Net-Worm.Win32.Mytob.cd, Mytob.cf, Mytob.ch and its automatically installed backdoor trojan as Backdoor.Win32.IRCBot.et. Online newspapers usually use the name Zotob-Worm.

The vulnerability mainly affects Windows 2000, but may be used to exploit Windows XP and 2003 Servers too, Microsoft says. Windows 98 and ME systems are not affected.

Once active, the worm downloads an IRC backdoor trojan from the internet which is used to remotely control the computer.

Protection:

Ensure, that you have already applied the Windows patch with the number KB899588 with your system. You can download the patch on the Microsoft website or use the automatic Windows-Update to install it automatically.

KB899588: http://www.microsoft.com/technet/security/...n/ms05-039.mspx

Windowsupdate: http://www.windowsupdate.com

Good advice! This virus struck my company today nationwide ... everything slowed down, printer servers had to shut down, W2K machines started rebooting automatically and repeatedly. Tooks all day for things to clear up ... very malicious!

Thanks Steve. Have just installed it.

One word of warning though, Microsoft in their usual arrogant style re-boot the system with no warning.

Thanks Steve.  Have just installed it.

One word of warning though,  Microsoft in their usual arrogant style re-boot the system with no warning.

<{POST_SNAPBACK}>

Strange - I didn't get that....... not even the option of a re-boot. I have XP Pro + SP2 and did a manual multi-patch update a week ago - so maybe the relevant patch was already in the batch then.

Incidentally, although I have my set-up configured for automatic updates, it didn't pick up the several that were available. Personally, I recommend checking/updating manually from time to time - same for spyware/virus updates.

Follow-on: just checked and the relevant Hotfix patch was installed separately yesterday (without any re-start).

Strange - I didn't get that....... not even the option of a re-boot. I have XP Pro + SP2

Very strange because I am also running XP Pro+sp2