Although this variant is not a mass-mailer like the previous two variants, it still exploits the Plug and Play service in Windows 2000.

With a minimum size of 11.897 bytes, the PE executable ranks as the smallest of all Zotob variants to date.

While based on the A variant, this worm seems to have been modified by a new author; supporting the theory that the source code is being distributed.

Although unable to propagate via e-mail, this variant spreads by exploiting a vulnerability in the Plug and Play service in Windows 2000.