W32.Zotob.H is a worm that opens a back door and exploits the Microsoft Windows Plug and Play Buffer Overflow Vulnerability (as described in Microsoft Security Bulletin MS05-039) on TCP port 445.
Note: While computers running Windows 95/98/Me/NT4/XP operating systems cannot be infected remotely, it is possible they could be infected if W32.Zotob.H is executed locally (although this is an unlikely occurrence). Vulnerable Windows 2000 computers could then be infected by the compromised computer.
When executed, W32.Zotob.H performs the following actions:
1. Creates the mutex "wintnpx.exe" so that only one copy of the worm runs on the compromised computer at one time.
2. Copies itself as the following file:
%System%\wintnpx.exe
Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
3. Adds the value:
"wintnpx.exe" = "wintnpx.exe"
to the registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
so that it runs every time Windows starts.
4. May fail to operate correctly if it detects it is not connected to a network or if the computer's IP address is non-routable.
5. Connects to the following IRC server on TCP port 6667 to listen for IRC commands:
24.128.76.161
6. Allows the attacker to use IRC commands to perform the following actions:
* Download and execute files from the IRC server.
* Delete the worm from the compromised computer.
7. Opens UDP port 69 for TFTP.
8. Sends packets to randomly generated IP addresses, based on the IP address of the compromised computer. The generated IP addresses then use the first 2 octets of the compromised computer and randomly generates values for the third and fourth octets. The worm will begin to generate entirely random IP addresses after 32 failures on local IP addresses or after 512 failures, if it was successful at least once.
9. Attempts to exploit the Microsoft Windows Plug and Play Buffer Overflow Vulnerability (as described in Microsoft Security Bulletin MS05-039) on TCP port 445.
10. If successful, the exploit code will open a back door using TCP Port 8563 on the remote computer.
11. Sends the file %Temp%\[NUMBER].bat to the target computer via the back door. This file contains a TFTP script that will download a copy of the worm from the compromised computer.
Note: [NUMBER] represents several random numbers from 0 - 9.
12. Saves the file as %Windir%\a[NUMBER].exe on the target computer and executes it.
13. Logs the successfully exploited IP addresses to the IRC server 24.128.76.161.
14. Ends the following processes:
* wintbpx.exe
* wintbp.exe
* svnlitup32.exe
* service32.exe
* mousebm.exe
* llsrv.exe
* pnpsrv.exe
* winpnp.exe
* csm.exe
* system32.exe
* botzor.exe
* upnp.exe
REMOVAL INSTRUCTIONSSee:
[url]http://securityresponse.symantec.com/avcenter/venc/data/w32.zotob.h.html[/url]
AlphaOne Technology Support Forums
Author
Logged
