Important Email Virus Alert

W32.Zotob.L

Virus Characteristics: W32.Zotob.L is a worm that opens a back door and exploits various vulnerabilities. The worm spreads by exploiting vulnerabilities, including the Microsoft Windows Plug and Play Buffer Overflow Vulnerability (described in Microsoft Security Bulletin MS05-039).

Type: Worm | Infection Length: 178,176 bytes | Systems Affected: Windows 2000/95/98/Me/NT/XP

When executed, W32.Zotob.L performs the following actions:

1. Creates the following mutex so that only one copy of the worm runs on the compromised computer at one time: beegees
2. Copies itself as %System%\windbg32.exe.
   Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
   
3. Adds the value:
   "Windows Debugger" = "windbg32.exe"
   to the registry subkey:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
   RunServices
   so that it runs every time Windows starts.
4. Connects to an IRC server on the p.wallload.com domain on TCP port 8080 to listen for IRC commands that allow the attacker to perform the following actions:
   • Download and execute files from the IRC server.
   • Delete the worm from the compromised computer.
5. Attempts to exploit the following vulnerabilities in order to spread:
   • Microsoft Security Bulletin MS05-039), using TCP port 445.
   • The Microsoft Windows Message Queuing Remote Buffer Overflow Vulnerability (as described in Microsoft Security Bullettin MS05-017).
   • The Microsoft Windows Workstation Service Remote Buffer Overflow Vulnerability (as described in Microsoft Security Bullettin MS03-049).
   • The Microsoft Windows ASN.1 Library Bit String Processing Variant Heap Corruption Vulnerability (as described in Microsoft Security Bulletin MS04-00).

Removal Tool:

For more information and/or a removal tool visit:

• http://securityresponse.symantec.com/avcenter/venc/data/w32.zotob.l.html