Re: zotob

I got the following information from a friend which may be helpful.....



Here is a link to the houseofdabus PoC code that Zotob.A/B/C is
based on:

http://packetstormsecurity.org/0508-exploits/HOD-ms05039-pnp-expl.c

FSecure is keeping up to date with the latest variants including
Zotob.C (http://www.f-secure.com/v-descs/zotob_c.shtml) which seems a
bit worse than the others as it can email itself and also exploit ASN.1
(MS04-007)

FSecure also mentioned that there is another worm appearing using the
PnP exploit to infect machines.

John