Updated Virus writers have created a botnet client that uses a recently discovered Microsoft vulnerability to spread. Mocbot (http://www.f-secure.com/v-descs/mocbot.shtml) uses the same MS05-039 (http://www.microsoft.com/technet/security/Bulletin/MS05-039.mspx) as the infamous Zotob worm in an attempt to create a botnet of compromised, "zombie" PCs under the control of hackers. Early indications are that the attack is not particular successful.

Mocbot tries to connect to two IRC servers in Russia, but the servers seem to be down (or overloaded), according to Finnish anti-virus firm F-Secure. "we received reports that the bot channel may instruct all joining bots to start automatically scanning for vulnerable computers, thus acting as automatic worms. But both channels used to control this spread are not working," said said Mikko Hyppönen, chief research at F-Secure.

Despite the relatively low risk from Mocbot users are strongly urged to patch against the vulnerability (MS05-039 (http://www.microsoft.com/technet/security/Bulletin/MS05-039.mspx)) exploited by both it and the more prolific Zotob worm. Zotob crashed (http://www.theregister.co.uk/2005/08/17/plug_and_play_worm_pandemonium) the networks of several high profile media outlets (including CNN, ABC, The Financial Times, and the New York Times shortly after its release in August. ®

Update

Early and, as it turns out, incorrect analysis suggested that Mocbot used a more recently Microsoft Plug and Play vulnerability, MS05-047 (http://www.microsoft.com/technet/security/Bulletin/MS05-047.mspx). This was incorrect. The confusion was caused by the exploit code used by Mocbot, which resembles a publicly available exploit code for MS05-047.

Related stories

How a virus crashed Homeland Security (3 November 2006)
http://www.theregister.co.uk/2006/11/03/zotob_dhs_outbreak/
Spammers adopt stealth tactics (20 February 2006)
http://www.theregister.co.uk/2006/02/20/stealth_spam/
Malware potency increases as numbers drop (25 January 2006)
http://www.theregister.co.uk/2006/01/25/ibm_cybercrime_report_2005/
Bot herder pleads guilty to 'zombie' sales (24 January 2006)
http://www.theregister.co.uk/2006/01/24/zombie_herder_pleads/
Pump-and-dump spam domains go silent after botnet closure (14 November 2005)
http://www.theregister.co.uk/2005/11/14/spam_domain_dump/
Suspected bot master busted (4 November 2005)
http://www.theregister.co.uk/2005/11/04/suspected_bot_master_busted/
October breaks malware production records (1 November 2005)
http://www.theregister.co.uk/2005/11/01/october_virus_chart/
Arrests 'unlikely' to impact botnet threat (13 October 2005)
http://www.theregister.co.uk/2005/10/13/rise_of_the_botnets/
Zotob arrests throws open trade in compromised PCs (30 August 2005)
http://www.theregister.co.uk/2005/08/30/zotob_arrests_follow-up/
Zotob suspects arrested in Turkey and Morocco (30 August 2005)
http://www.theregister.co.uk/2005/08/30/zotob_suspects_arrested/
Worm War II (18 August 2005)
http://www.theregister.co.uk/2005/08/18/pnp_worm_wars/
Plug and Play pandemonium (17 August 2005)
http://www.theregister.co.uk/2005/08/17/plug_and_play_worm_pandemonium/
IRC bot latches onto Plug-and-Play vuln (16 August 2005)
http://www.theregister.co.uk/2005/08/16/irc_bot/