| Alias/es | CME-164, Net-Worm.Win32.Mytob.cf [KAV], W32.Zotob.B [NAV], W32/Zotob-B [Sophos], W32/Zotob.B [F-Prot], W32/Zotob.B!worm, W32/Zotob.B-wm, W32/Zotob.worm [McAfee], WORM_ZOTOB.B [Trend] |
| Release Date | Aug 14, 2005 |
| Detection Availability | Current Antivirus Definition Database Version: 12.323 | | CVE | CME-164 |
| Description | Visible Symptoms
- Creation of the file "csm.exe" into the System32 folder, with
a file size of 15,386 bytes
- CVE Reference: CAN-2005-1983
Detailed Analysis This virus writes itself to the System32 folder as "csm.exe" and
creates a Mutex named "B-O-T-Z-O-R" to prevent loading more than one
instance
When this virus is run, it registers to load at Windows startup via the registry
-
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
"csm Win Updates" = \csm.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
"csm Win Updates" = \csm.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
"csm Win Updates" = \csm.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
"csm Win Updates" = \csm.exe
The virus will alter Internet Explorer registry settings -
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
start = "4"
Used to prevent Windows 2000/XP shared access
The virus blocks access attempts to various Antivirus and security vendor
sites by modifying the "hosts." domain name resolution file; all modified
site names are redirected back to the infected host; copy of modified "hosts"
file below -
www.symantec.com
securityresponse.symantec.com
symantec.com
www.sophos.com
sophos.com
www.mcafee.com
mcafee.com
liveupdate.symantecliveupdate.com
www.viruslist.com
viruslist.com
viruslist.com
f-secure.com
www.f-secure.com
kaspersky.com
kaspersky-labs.com
www.avp.com
www.kaspersky.com
avp.com
www.networkassociates.com
networkassociates.com
www.ca.com
ca.com
mast.mcafee.com
my-etrust.com
www.my-etrust.com
download.mcafee.com
dispatch.mcafee.com
secure.nai.com
nai.com
www.nai.com
update.symantec.com
updates.symantec.com
us.mcafee.com
liveupdate.symantec.com
customer.symantec.com
rads.mcafee.com
trendmicro.com
pandasoftware.com
www.pandasoftware.com
www.trendmicro.com
www.grisoft.com
www.microsoft.com
microsoft.com
www.virustotal.com
virustotal.com
www.amazon.com
www.amazon.co.uk
www.amazon.ca
www.amazon.fr
www.paypal.com
paypal.com
moneybookers.com
www.moneybookers.com
www.ebay.com
ebay.com
This virus contains the following text string but is not displayed -
Botzor2005 Made By....
Greetz to good friend Coder. Based On HellBot3
MSG to avs: The first av who detect this worm will be the first killed in
the next 24hours! ! !
This virus binds to TCP port 33333 and can receive common FTP commands such
as USER, PASS, SYST, REST, PWD, TYPE, PORT, RETR, QUIT and so on
The virus connects to the IRC server named "wait.atillaekici.net"
using TCP port 8080 awaiting instructions from a hacker
The virus starts up to 200 processes to search for other computers using
TCP port 445 - for each system found, the virus sends PnP exploit code to that
system [an attack against pre-MS05-039 systems] |
Description Last Updated Date: Aug 22, 2005
Reference: ID - 71432
|