Zotob worm finds its path limited

TalkBack 5 of 13:

Next »

« Previous

• Thread View
• Flat View

How?

Seriously, everything I've read about this stupid exploit neglect to tell you how it infects you in the first place. I've got some guesses based on what it does though.

From what I gathter it searches for 445 ports and infects through there where it downloads the pay load via FTP on Port 33333 then connects to IRC to await commands. So if Port 445 is the infection route, neve clearly states it, that means a basic Firewall should prevent this. I know I'd never open port 445 for incomming traffic on the internet.

Of course an infected laptop could do you in but if you block no standard out going FTP ports the Payload would not be downloaded. This would alert you to the problem laptop and you neutralize it.

Posted by: voska   Posted on: 08/16/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• The True Costs of Virtual Server Solutions VMware In an economic environment that is repeatedly heralding the message "do ... Download Now
• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now
• The Impact of Virtualization Software on Operating Environments VMware Today's use of virtualization technology allows IT professionals to ... Download Now