W32/Zotob.D is a mass mailing worm. This worm is a variant of W32/Zotob.A. The worm will infect Windows systems and spreads through email.

This worm exploits PnP vulnerability present in Windows as explained by Microsoft Security Bulletin MS05-039.

Upon execution, the worm copies itself as windrg32.exe in the Windows System folder.

It modifies the Windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

This worm attempts to find internet connectivity by connecting to some websites in the pre-configured list.

It also tries to terminate some processes running in the infected system.

This worm will generate random IP adresses to exploit the PnP vulnerability. If the port is open on any of the generated IP address, then it will exploit that system.

Microsoft has released the patch for the MS05-039 vulnerability. They can be downloaded from the following links:

http://www.microsoft.com/technet/security/bulletin/MS05-039.mspx

Users should apply these patches downloaded from the links provided above to remove the vulnerabilities inherent in the system.

This worm first appeared on 17th August, 2005.

 Other names of W32/Zotob.D Worm:

This Worm is also known as WORM_ZOTOB.D, W32.Zotob.D.