Zotob

Zotob was a 2005 computer worm that exploited security vulnerabilities such as the MS05-039 plug-and-play vulnerability in Microsoft operating systems. The worm has been known to spread on Microsoft-ds or TCP port 445. Farid Essebar and Atilla Ekici were arrested for writing and distributing the worm.

Microsoft employed 50 investigators and offered a $250,000 reward for the capture of the hackers. Microsoft's General counsel noted on 26 August 2005 that "The fact that we were able to see these arrests in less than two weeks and see them halfway around the world really drives that point home." The Zotob worms cost an average of $97,000 as well as 80 hours of cleanup per company affected. According to Business Week, the Zotob worm and its variations infected computers at companies such as ABC, CNN, The Associated Press, The New York Times, and Caterpillar Inc.

Rbot variant

Zotob was derived from the Rbot worm, which can force an infected computer to continuously restart. Its outbreak on August 16, 2005, was covered "live" on CNN television, as the network's own computers became infected. Zotob would self-replicate each time the computer rebooted, resulting in each computer having numerous copies of the file by the time it was purged.

Sequence of events

August 9, 2005: Security advisory"On August 9th, Microsoft released critical security advisory MS05-039 which revealed a vulnerability in the Plug-and-Play component of Windows 2000.