943,339 Members | Top Members by Rank

Community Center > IT Professionals' Lounge > New Windows Bug
Ad:
Permalink
Aug 16th, 2005
0

New Windows Bug

Expand Post »
Attention Microsoft Users --

As of late Tuesday afternoon Chicago time, major news networks are reporting being affected by a new bug called Zotob. It affects Microsoft systems, as described in a Microsoft Bulliton MS05-039, a document that was released earlier this month. CERT sources say that they have seen several variets of the Zobot [sic] worm. The Worm is reported to scan for vunerable systems on port 445.

Port 445 is part of the protocols that Microsoft uses for directory services.

Interestingly enough, as I am typing this to you, Microsoft has not made any publications on it's main website about the situation, nor has provided a "protect yourself now" link.

People are encouraged to do the following:

* Close port 445 on your firewall.
* Update your computer to the latest set of Microsoft fixes using Windows Update. Install those updates, and REBOOT your computer
* Update your Antivirus technologies
* Check your computer to see if you have an FTP server running on TCP port 1117

According to Symantec's website, the worm iaffects all flavors of Windows out there, except for Windows 3.1 It will also affect Windows Servers.

As for me, I will be watching this play out from the comfort of my Macintosh.

Christian
Similar Threads
Team Colleague
Reputation Points: 121
Solved Threads: 57
Posting Virtuoso
kc0arf is offline Offline
1,629 posts
since Mar 2004
Permalink
Aug 16th, 2005
0
Re: New Windows Bug
It seems unclear whether the worm infecting CNN and others is Rbot or Zotob. Someone from trendmicro was on CNN earlier saying it was probobly Rbot, but CNN was saying Zotob before that.

It seems to me though that these news organizations are making a big deal out of an ordinary worm simply because they have been infected. The internet traffic report as remained steady throughout the afternoon, indictating that the worm is not widespread enough to have any significant effect on the internet.

SANS has an interesting hypothesis that NYTimes, ABC, and CNN were all at the same event at some point recently had had their laptops on the same network, and that in this way the worm got past the firewalls of the news organizations and on to their networks. This seems likely to me. I have seen no indication thus far in my router log that this worm has tried to spread to my network.
Reputation Points: 10
Solved Threads: 0
Light Poster
benna is offline Offline
46 posts
since Aug 2005
Permalink
Aug 16th, 2005
0
Re: New Windows Bug
Is it just me or is this related to Danny's CNN blog entry?

http://www.daniweb.com/blogs/entry313.html

Gahh, benna posted at the same time as me!
Administrator
Staff Writer
Reputation Points: 1422
Solved Threads: 162
The Queen of DaniWeb
cscgal is offline Offline
13,645 posts
since Feb 2002
Permalink
Aug 16th, 2005
0
Re: New Windows Bug
Also, and I say this not to lull anyone into a false sense of security, but this VIRUS (a "bug" is a software mistake; this mess is intentional mischief) right now is primarily targeting Windows 2000-based machines. But again, don't leave yourself unprotected just because you have another version.

I'm watching all this in comfort myself; from the comfort of common sense
Reputation Points: 10
Solved Threads: 2
Posting Whiz in Training
Toulinwoek is offline Offline
274 posts
since Mar 2005
Permalink
Aug 16th, 2005
0
Re: New Windows Bug
Hi,

This is not related to Danny's entry. He was talking about the social aspects, and didn't offer any technical information on it. He also titled his posting on CNN, and anyone who doesn't give a damn about CNN probably won't read it. Mine is titled to the point.

I also see Windows as being Buggy software. It is a virus. But Windows is buggy software.

I am going to check my traffic graphs later this evening to see if the noise floor has grown or not.

Christian
Team Colleague
Reputation Points: 121
Solved Threads: 57
Posting Virtuoso
kc0arf is offline Offline
1,629 posts
since Mar 2004
Permalink
Aug 17th, 2005
0
Re: New Windows Bug
Christian -- Firstly, it's not a virus, it's a worm. CNN called it both, but just to be official, its a worm. Worm worm worm.

I have updated my blog title to reflect the content better. The fact is, this is vulnerability is not present in all versions of Windows. Its only W2K and out-of-date versions of XP.

The rest of us are fine. And in fact, Microsoft has responded. You should have looked harder. The official MSRC blog has info: http://blogs.technet.com/msrc/archive/2005/08/15/409169.aspx

My computer, (XP Pro with SP2) was never at risk. Since most users with XP use automatic-windows updates, they probably will be fine too. W2K is not a very common OS anymore.

As per your Mac: Don't even go there. Macs are a much smaller market share than PCs, so theres much less of an incentive to create malicious software for them. Its common sense.
Reputation Points: 8
Solved Threads: 0
Junior Poster
Danny is offline Offline
193 posts
since May 2004
Permalink
Aug 17th, 2005
0
Re: New Windows Bug
And so the reason Microsoft has not reacted is because they proacted by releasing an update that closes this hole they themselves reported at the time they reported it.
If people choose to neglect their security updates (for whatever software they use, not just Windows but your precious MacOS as well) they put themselves at risk and have noone but themselves to blame if they get compromised.
Team Colleague
Reputation Points: 1658
Solved Threads: 331
duckman
jwenting is offline Offline
7,719 posts
since Nov 2004
Permalink
Aug 17th, 2005
0
Re: New Windows Bug
Proacted isn't a word.
Reputation Points: 10
Solved Threads: 0
Light Poster
benna is offline Offline
46 posts
since Aug 2005

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Message:
Previous Thread in IT Professionals' Lounge Forum Timeline: Eighty is the Magic Number for Firefox
Next Thread in IT Professionals' Lounge Forum Timeline: ValueClick to Acquire FastClick





About Us | Contact Us | Advertise | Acceptable Use Policy
Forum Index | Build Custom RSS Feed


Follow us on Twitter


© 2011 DaniWeb® LLC