Alert Number: AL05-001
W32.Zotob.E,W32/ircbot.worm!ms05-039, WORM_RBOT.CBQ
16 August 2005

Purpose
The purpose of this advisory is to bring attention to the W32.Zotob.E worm (aka W32/ircbot.worm!ms05-039, WORM_RBOT.CBQ).

Assessment
This worm opens a back door and exploits the Microsoft Windows Plug and Play Buffer Overflow Vulnerability (described in Microsoft Security Bulletin MS05-039) on TCP port 445. Upon execution, this worm drops a copy of itself in the Windows system folder as WINTBP.EXE.

It creates the following registry entry to ensure it automatically executes during every Windows startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
wintbp.exe = "wintbp.exe"

This worm creates multiple threads, each capable of generating a random IP addresses for it to target. Each thread checks if port 445 is open on the target IP addresses. If it is open, it attempts to exploit the target system. If successful, this worm opens a remote shell on port 7778. It then opens a TFTP service and drops and executes a file in the exploited system. After execution, this worm then creates a script batch file to delete the dropped file.

This worm also connects to the IRC server 72.20.27.115, if it is active, and joins the channel #tbp. It sends the following messages to the channel:

{Random} :ER DL FH
{Random} :ER DL IF

Suggested Action
PSEPC recommends that you ensure your anti-virus detection software definitions are current.

Additional information about this worm is available at the following links:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM
%5FRBOT%2ECBQ&VSect=P
http://securityresponse.symantec.com/avcenter/venc/data/w32.zotob.e.html
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=135491