MS05-039 Updated advisory (incl. Win32/ZOTOB.A Info)


Microsoft has updated the MS05-039 advisory and provides a link to this site for more information about the worm:
http://www.microsoft.com/security/encyclopedia/details.aspx?name=Worm:Win32/Zotob.A


It also provides a link to this site for more information regarding Microsoft’s guidance:
www.microsoft.com/security/incident/zotob.mspx


This Microsoft Security Advisory is located at this location:
http://www.microsoft.com/technet/security/advisory/899588.mspx


According to US-CERT, Blocking inbound connections to port 445 will provide protection against this worm.
The FTP server that the worm sets up does not run on the standard FTP port, but runs on 33333/TCP.
In addition, US-CERT has received a report that the IP address 84.244.6.162 is being used to further propagate Zotob infections.


Urs


Comments (1)