W32/Zotob.D Worm

 Virus Information - W32/Zotob.D Worm:

W32/Zotob.D is a worm. This worm is a variant of W32/Zotob.A. The worm will infect Windows systems and spreads through networks.

This worm exploits PnP vulnerability present in Windows as explained by Microsoft Security Bulletin MS05-039.

Upon execution, the worm copies itself as windrg32.exe in the
Windows System\wbev folder.

It modifies the Windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

This worm attempts to find internet connectivity by connecting to some websites in the pre-configured list.

It also tries to terminate some processes running in the infected system.

This worm will generate random IP adresses to exploit the PnP vulnerability. If the port is open on any of the generated IP address, then it will exploit that system.

Microsoft has released the patch for the MS05-039 vulnerability. It can be downloaded from the following link:

http://www.microsoft.com/technet/security/bulletin/MS05-039.mspx

Users should apply these patches downloaded from the links provided above to remove the vulnerabilities inherent in the system.