Security experts offer calm in the Windows Plug-and-Play storm

The ZOTOB worm first appeared shortly after Microsoft's "Plug-and-Play" vulnerability announcement last Friday (12AUG05), in which the world's largest software maker warned of three new "critical" security flaws in Windows, including one that could potentially allow hackers to seize complete control of a computer. Since the announcement, malware writers have been working overtime to exploit the vulnerability, before users have a chance to patch their machines.

While the original worm seemed initially to have caused minimal damage, security analysts at Trend Micro have since discovered several new variants of ZOTOB, as well as other bots, which have been spreading much faster. Bots are worms that have the capability to propagate via a network of "zombie" computers, which have been infected without the user's knowledge.

Samir Kirouani, technical manager, Trend Micro Middle East, explained, "This is common among malware writers. The original code is written and posted to a public web site; other writers then modify the code, adding functionality, such as more advanced seeding and propagation techniques, to make the malware more destructive."

However, while many antivirus firms have been calling for heightened global awareness, experts at Trend Micro have offered an objective analysis of the threat, as well as setting out measures to minimise the risk.

Samir Kirouani, technical manager, Trend Micro Middle East, explained: "Contrary to many reports that the ZOTOB worms can infect Windows 95, 98, and ME, and NT, these platforms are not susceptible to the vulnerability. The worm only spreads to systems running on Windows 2000, XP and Server 2003, and even then, the possibility of the worm affecting Windows XP and Server 2003 are minimal. Nevertheless, despite the relatively low worldwide infection rate, this worm can, in theory, spread and infect computers extremely fast. Computer users need to remain vigilant and take immediate measures to protect against this and other attacks," warned Kirouani.

The proliferation of the worm means that there is potential for significant infection throughout the Middle East, because any Windows 2000 system than hasn't been patched yet is vulnerable. Trend Micro has a dedicated free up-to-date on-line scanner on the Web - http://housecall.trendmicro.com - which offers simple advice on safe computing practices and on reducing the risk of becoming infected or infecting others.