FRISK Software International

Summary of W32/Zotob.B
Discovered: 15 Aug 2005
Definition files: 15 Aug 2005
Risk Level: Medium
Jump to:
Brief description
Technical description
Removal Instructions

Brief Description

W32/Zotob.B has the same functionality as W32/Zotob.A, but differs in its code which has undergone slight modifications and some key data changed, e.g. IRC server, user, password, etc.

Technical Description

A packed PE executable like the previous variant, W32/Zotob.B seems to have shrunk a whole 3 bytes as it is now 15.386 bytes long.

The shell code for the exploit is still designed for Windows 2000, and is only able to infect computers running this operating system

Removal Instructions
For general removal instructions please click here.

rstur Snr Eisson

Stay up to date with important developments via e-mail.
Stay up to date with life cycle policies for F-PROT Antivirus for Windows.
Virus news and information directly to your desktop.
Definitions of common antivirus terminology.
For further virus information, please try our partners' websites:


perComp Verlag
(in German)