Virus writers have created a worm that spreads using a Microsoft Plug-and-Play vulnerability (http://www.microsoft.com/technet/security/Bulletin/MS05-039.mspx) disclosed only last week. The ZoTob (http://www.f-secure.com/v-descs/zotob_a.shtml) worm exploits a security weakness detailed just five days prior to its arrival last weekend.

Two variants of ZoTob have been discovered so far. Each allows hackers to seize control of vulnerable PCs. Both share many similarities with the earlier MyTob worm, according to Finnish anti-virus firm F-Secure, which reckons the malware is based on exploit code published by 'houseofdabus' four days ago.

The spread of ZoTob provokes comparisons with the infamous Sasser worm even though it's nothing like as aggressive. Sasser was released just two days after the same hacker released exploit code for the infamous LSASS vulnerability that underpined Sasser.

F-Secure notes that ZoTob fails to infect Windows XP SP2 machines. It also won't infect machines that block the port via which it spreads (445/TCP) either, further limiting the scope for infection. Windows users (particularly those running Windows 2K, the most vulnerable platform) are urged to apply Microsoft patches lest they get infected. The vulnerability was discovered by ISS. Security firm eEye has released a free scanning tool here (http://www.eeye.com/html/resources/downloads/audits/index.html). ®

Related stories

How a virus crashed Homeland Security (3 November 2006)
http://www.theregister.co.uk/2006/11/03/zotob_dhs_outbreak/
Zotob perp jailed (13 September 2006)
http://www.theregister.co.uk/2006/09/13/zotob_perps_jailed/
Dasher update pierces Windows flaw (16 December 2005)
http://www.theregister.co.uk/2005/12/16/dasher_worm_variant/
Dasher worm targets October Windows vuln (15 December 2005)
http://www.theregister.co.uk/2005/12/15/dasher_worm/
Kaspersky in heap-based buffer overflow vuln (4 October 2005)
http://www.channelregister.co.uk/2005/10/04/kaspersky_glitch/
MS pulls upcoming Windows security patch (12 September 2005)
http://www.theregister.co.uk/2005/09/12/ms_pulls_security_patch/
Zotob arrests throws open trade in compromised PCs (30 August 2005)
http://www.theregister.co.uk/2005/08/30/zotob_arrests_follow-up/
Zotob suspects arrested in Turkey and Morocco (30 August 2005)
http://www.theregister.co.uk/2005/08/30/zotob_suspects_arrested/
Exploit for unpatched IE vuln fuels hacker fears (19 August 2005)
http://www.theregister.co.uk/2005/08/19/0day_ie_exploit_fears/
Worm War II (18 August 2005)
http://www.theregister.co.uk/2005/08/18/pnp_worm_wars/
Plug and Play pandemonium (17 August 2005)
http://www.theregister.co.uk/2005/08/17/plug_and_play_worm_pandemonium/
IRC bot latches onto Plug-and-Play vuln (16 August 2005)
http://www.theregister.co.uk/2005/08/16/irc_bot/
Zombie bots fuel spyware boom (11 July 2005)
http://www.theregister.co.uk/2005/07/11/malware_report_mcafee/
VXers go phishing with latest MyTob worms (8 June 2005)
http://www.theregister.co.uk/2005/06/08/mytob_phishing_worm/
Window of exposure lets viruses run rampant (2 June 2005)
http://www.theregister.co.uk/2005/06/02/virus_exposure_stats/