FRISK Software International

Summary of W32/Zotob.E
Discovered: 24 Aug 2005
Definition files: 24 Aug 2005
Risk Level: Medium
Infection Method:Network
Jump to:
Brief description
Technical description
Removal Instructions

Brief Description

Although this variant is not a mass-mailer like the previous two variants, it still exploits the Plug and Play service in Windows 2000.

Technical Description

With a minimum size of 11.897 bytes, the PE executable ranks as the smallest of all Zotob variants to date.

While based on the A variant, this worm seems to have been modified by a new author; supporting the theory that the source code is being distributed.

Although unable to propagate via e-mail, this variant spreads by exploiting a vulnerability in the Plug and Play service in Windows 2000.

Removal Instructions
For general removal instructions please click here.

rstur Snr Eisson

Stay up to date with important developments via e-mail.
Stay up to date with life cycle policies for F-PROT Antivirus for Windows.
Virus news and information directly to your desktop.
Definitions of common antivirus terminology.
For further virus information, please try our partners' websites:


perComp Verlag
(in German)