ZOBOT Question ...

[skwerlbaitbev]

Greetings, PC Correspondents ...
Re the ZOBOT worm, it's being reported that 'merely opening' an 'infected email' will cause this worm to 'execute' its nefarious scheme. But I'm wondering, is this 'true' when one is using an ISP like AOL, whereby email is opened 'on their server', and not 'downloaded automatically' to one's PC? I use AOL. If I read email, without 'saving' to my PC, then I don't have access to the email 'off line'. I though that this is what was meant, by 'reading email on the server' - that the email is not actually downloaded to my PC, and thus, reading email on the server is 'safer' than reading email by downloading first (it's my understanding that using 'Outlook Express' automatically downloads mail when it's opened, and thus any email with a file attached set to automatically 'execute' makes the viewing PC vunerable ...) Indeed, with email, if I decide to 'save' the e, a window pops up, asking if I want to save said email to my 'AOL' filecabinet, or to 'My Documents' - IOW, the email can be read when I'm off line, but if I save it to AOL, I have to open the AOL programme first, before I can access the email ...

I'm sure this is a very basic question, but although I googled for a definitive answer, I could not find such. Please advise ....

[classicsoftware]

This worm is NOT activated by e-mail or by visiting a web site. This worm is activated if you are on the internet and broadcasting an IP address. The worms scans for unprotected PC's and then as soon as it finds one, you've got it.

As for gist of your note, I agree the ISP's should filter a whole lot of this stuff on their end. They are just not prepared financially to do so.

[skwerlbaitbev]

I'm still confused, on this ZOBOT thing (and on life, in general, of course ...). If I'm online, doesn't it stand that I am in fact 'broadcasting' an IP 'address' (If I were not, how would others communicate with me, at all - how would I receive email, or be able to 'open' a website?)? It seems, from what I did read, I'm not likely to be at risk, for this particular worm. I'm using Windows XP Home, and I do have the SP2 upgrade - and my 'security setting' is to auto download upgrades to the Windows programme (I ran a check via Microsoft's site, and it seems I'm 'up to date' with this notebook pc ...). I do have Norton installed - but truth be told, I've not renewed my 'contract', so although I've been doing daily virus scans, I've not the 'latest' definitions, where viruses are concerned. AOL offers McAfee 'free', with free updated definitions, and I've been considering removing the Norton, and installing the McAfee - but I have not done so, just yet. (I do have the AOL McAfee installed on my desktop, and it seems just fine). I do have Lavasoft's Ad Aware, and have not gotten a report, since the first scan and cleanup, of any spyware or adware surreptitiously installed. I guess I just don't follow what the 'news' broadcast meant, when they reported that this worm could infect a pc by simply opening and email, not requiring one to download an attachment ... I can 'read' my AOL email at the public library - I though it was indeed because I was reading it on AOL's server, not actually on the PC ... sigh. This stuff is just a bit beyond me, I fear.

[PrntRhd]

Zobot only affects Windows 2000 PCs, at least so far. It only infects those Windows 2000 PCs that have not been patched up to current standards.

This is a worm, not spyware/adware so Adaware may or may not detect it, it is more likely detected by anti-virus applications, and users will see spontaneous reboots every minute or so, similar to Sasser symptoms.

[ErnieK]

Go to the following link for MS's checker/removal tool. Can be run on line (using IE) or downloaded and run from computer

http://www.microsoft.com/security/malwareremove/default.mspx#run
http://www.microsoft.com/downloads/thankyou.aspx?familyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displayLang=en (for download)