What's the Zotob MS05-039 worm?

Feisty users, the bane of all IT departments! Just kidding. Actually, the Zotob worm is interesting in that it's only attacking Windows 2000 systems (which means if you're not running Win2k you're safe) and that it appears to be two different hackers actually having what the Wall Street Journal says is calling an Internet crime turf war! (Hollywood, are you listening?)

The sequence of events behind this particular worm are that about a week ago Microsoft announced a vulnerability in the Plug-and-Play subsystem in Windows 2000 and issued a security update or "patch" that prevented people from being infected. The worm authors then promptly swung into action, producing nine different variations on worms that attacked the specific identified vulnerability.

Tip: A worm is a self-replicating program, one that tries to spawn copies of itself on as many other systems as it can find while also, typically, doing something malicious on the host machine.

In fact, if your IT department had been properly on the ball and had updated all the Windows 2000 systems in your department, you would have been able to sit back, breath easily, and know that Microsoft had saved the day. By not applying the security patch promptly, your systems are indeed possibly at risk for this worm that's caused significant havoc at organizations running the earlier version of Windows.

You'll know if you're infected because your computer will continually restart. Learn more about exactly how to tell if you're infected - including the specific file or files created by the worm - at Microsoft's What You Should Know about Zotob.

If you already have been infected, then try running an antivirus program, getting the very latest updates from the vendor, then running it again. Hopefully that'll fix things.

If you haven't been infected, but are running Windows 2000, use the built-in Windows update capabilities, or check out Symantec's Zotob Removal Instructions.

Finally, my advice to you? Listen to your IT department and apply the very latest set of patches from Microsoft now, not later.