Microsoft Offers Zotob Removal Tool
Posted by malebolgia on 18 August 2005 - 18:53 · 18 comments & 3528 views
Microsoft has made available a free software tool to help victims of the worms that hit Windows computers in the past days clean their systems.

The Zotob worm started spreading on Sunday. Since then, the worm, its variants, and other worms that take advantage of the same security flaw have hit Windows computers, especially those running Windows 2000. Systems at ABC, CNN and The New York Times were among those infected.

The cleaning program, released Wednesday, is an updated version of Microsoft's Windows Malicious Software Removal Tool, said Debby Fry Wilson, a director at the company's Security Response Center. "You click on it and it will tell you if you are infected," she said. "And if you are, it will clean the worm off your PC."

Download: Microsoft's Virus/Worm Removal Tool
News source: C|Net News.com

What's Included: (new/updated entries are marked like this):

Windows XP SP2 - Critical Updates
KB873333: Security Update for Windows XP
KB873339: Security Update for Windows XP
KB873374: Microsoft GDI+ Detection Tool
KB884883: Security Update for Windows XP v8
KB885250: Security Update for Windows XP
KB885626: Critical Update for Windows XP
KB885835: Security Update for Windows XP
KB885836: Security Update for Windows XP
KB886185: Critical Update for Windows XP
KB888113: Security Update for Windows XP
KB888302: Security Update for Windows XP
KB890046: Security Update for Windows XP
KB890175: Security Update for Windows XP
KB890859: Security Update for Windows XP
KB891781: Security Update for Windows XP
KB893066: Security Update for Windows XP
KB893086: Security Update for Windows XP
KB896358: Security Update for Windows XP
KB896422: Security Update for Windows XP
KB896428: Security Update for Windows XP
KB898458: Security Update for Windows XP
KB901214: Security Update for Windows XP
KB890830: Malicious Software Removal Tool v1.7
KB893756: Security Update for Windows XP
KB896423: Security Update for Windows XP
KB896727: Cumulative Security Update for IE6 for Windows XP SP2
KB899587: Security Update for Windows XP
KB899588: Security Update for Windows XP
KB899591: Security Update for Windows XP

Windows XP SP2 - Recommended updates
KB831240: Update for HighMAT support in the Windows XP CD Writing Wizard
KB884020: Update for Windows XP
KB885222: Update for Windows XP
KB886677: Update for Windows XP
KB886716: Update for Windows XP
KB887742: Update for Windows XP
KB887797: Cumulative Update for Outlook Express for Windows XP
KB888240: Update for Internet Explorer 6
KB888656: Update to enable DirectX Video Acceleration of Windows Media Video content in WMP 10
KB889527: Update for Windows XP v3
KB891122: Update for DRM-enabled Media Players
KB892313: Updates for Windows Media Player 9 and 10
KB893357: Update for Windows XP
KB894391: Update for Windows XP
KB895181: Fix for MPEG4 videos in Windows Media Player 10
KB896344: Update for Windows XP
KB896626: Update for Windows XP
KB898461: Update for Windows XP
KB900930: Update for Windows XP
KB903234: Update for Windows XP

Components
.NET Framework 1.1 (+SP1) (only in Full)
- KB886903: Security Update for .NET Framework 1.1 SP1
MSN Messenger 7.0.0816 (only in Full)
Windows Installer 3.1 (v2)
Microsoft Journal Viewer 1.5.2316.0 (only in Full)
Windows Media Connect (only in Full)
Windows Media Player 10.0.3802 (only in Full)
Windows Messenger 5.1.0680 (only in Full)
Windows Script 5.6 for Windows XP (v5.6.0.8825) (only in Full)
MSN Messenger 7.0.0816 (only in Full)

Add-ons
Adaptec ASPI
Bootvis 1.3.37 (only in Full)
Official Windows XP PowerToys
Copy Profile Tool
DirectX Control Panel
PowerMenu 1.5.1
Startup Control Panel 2.8
New XP Style Wallpapers (only in Full)
New XP Screensavers (only in Full)
New Wallpapers (only in Full)
New AutoPatcher Wallpaper (only in Full)
New Theme: Royale (only in Full)
Macromedia Shockwave Player 10.1 (only in Full)
Sun Java 1.5.0_04 (only in Full)
Google Toolbar 3.0.125.1 (only in Full)

And of course a lot of registry tweaks which improve speed, appearance, functionality and security!


File Size & MD5 Hashes

Sizes & Hashes
English August 2005 Full File Size: 155 MB (163195627 bytes)
English August 2005 Full MD5 Hash: C1C304BE866B8BF6FFA054851F94FA73
English August 2005 Lite File Size: 75.2 MB (78902237 bytes)
English August 2005 Lite MD5 Hash: 5B8F79CCA4D91CE4E88F4DFF9C5B2077

Portuguese August 2005 Full File Size: 151 MB (158833871 bytes)
Portuguese August 2005 Full MD5 Hash: F15953B7D55EAA2C060776ACD618686D
Portuguese August 2005 Lite File Size: 68.1 MB (71504365 bytes)
Portuguese August 2005 Lite MD5 Hash: 4EFFA6E90E0F3046428F9B9A4733759F

Polish August 2005 Full File Size: 143 MB (150135248 bytes)
Polish August 2005 Full MD5 Hash: DA572312391029130D1343752A1578D2
Polish August 2005 Lite File Size: 68.7 MB (72090866 bytes)
Polish August 2005 Lite MD5 Hash: 52D84471F15F15EC1DFEA687CC9F50EC


There are 18 additional comments
Advertisement
Quote this comment Reply to this comment #1 Posted by jivemastert on 18 Aug 2005 - 19:19
that was quick. wow.
(2 replies) Quote this comment Reply to this comment #2 Posted by depakote on 18 Aug 2005 - 19:26
No one cares.
Quote this comment #2.1 Posted by PCyr on 18 Aug 2005 - 20:00
So why did you reply? I'm sure the people infected care.
Quote this comment #2.2 Posted by xpgeek on 18 Aug 2005 - 22:51
I'm not infected, but I care. This makes it easy for me to remove it from infected pc's. A couple people in my apartment building got it and they all called me.
(1 reply) Quote this comment Reply to this comment #3 Posted by eric53110 on 18 Aug 2005 - 19:40
he he, do you have to vaildate your pc so that you can download this from MS??
Quote this comment #3.1 Posted by rm20010 on 18 Aug 2005 - 20:05
Don't know about the ActiveX, but downloading the tool via this download page doesn't ask anything about WGA.
(1 reply) Quote this comment Reply to this comment #4 Posted by OceanMotion on 18 Aug 2005 - 19:45
so how do you run the tool ?
Quote this comment #4.1 Posted by jwjw1 on 18 Aug 2005 - 20:15
removed

Last edited by 11622 on 19 Aug 2005 - 14:10
(3 replies) Quote this comment Reply to this comment #5 Posted by renshaw2k4 on 18 Aug 2005 - 19:51
i'm guessing its a dos boot disc? that scans saying it for windows 2000
Quote this comment #5.1 Posted by PCyr on 18 Aug 2005 - 20:01
DOS doesn't exist in NT-based versions of Windows. Not to mention DOS can't read NTFS partitions.
Quote this comment #5.2 Posted by markjensen on 18 Aug 2005 - 22:10
Take it easy. A boot disk could certainly be DOS or Linux or any of another set of OSes. It doesn't have to match the OS on the PC. Also, there are hacks to add NTFS read support to DOS. Not practical for virus removal, but perhaps the O.P. heard partial information on this.
Quote this comment #5.3 Posted by PCyr on 18 Aug 2005 - 23:58
QUOTE
Take it easy.

Huh? My first sentance completely lacks emotion, my second one could have a hint of emotion either neutral or negative.

QUOTE
A boot disk could certainly be DOS or Linux or any of another set of OSes. It doesn't have to match the OS on the PC. Also, there are hacks to add NTFS read support to DOS. Not practical for virus removal, but perhaps the O.P. heard partial information on this.

Correct, however given the fact that MS doesn't work on/with DOS anymore, there's no likelyhood that it is a DOS disk, especially when they would have to spend time hacking it to make it work with NTFS.
Quote this comment Reply to this comment #6 Posted by Jason on 18 Aug 2005 - 22:21
What sort of a name is Zotob, only a computer geek could make that rubbish up
(1 reply) Quote this comment Reply to this comment #7 Posted by ecotrojan on 19 Aug 2005 - 07:40
link on front page is dead ?
Quote this comment #7.1 Posted by vetmalebolgia on 19 Aug 2005 - 14:38
Working just find on this end.
(2 replies) Quote this comment Reply to this comment #8 Posted by Vandil on 19 Aug 2005 - 13:27
I hope computer virus writers return to the old school era of making viruses that delete/destroy their host's system.

If CNN, ABC News, and the NY Times were afflicted with a virus that deleted their affected systems (instead of rebooting them endlessly), I'm sure the spin on this story would be far different.

Windows may be the OS used by the majority, but that can change fast if a destructive virus were to come out.
Quote this comment #8.1 Posted by markjensen on 19 Aug 2005 - 13:42
QUOTE
I hope computer virus writers return to the old school era of making viruses that delete/destroy their host's system.
Unfortunately there isn't money or prestige in crashing people's PCs.

It is making a cluster of zombie PCs potentially useful for adware, spam, information harvesting, DDoS attacks and so forth that is a bigger draw then wiping out PCs. Malware that completely wipes out the host doesn't propogate that well.
Quote this comment #8.2 Posted by Vandil on 21 Aug 2005 - 11:01
How about one that sends out 20 copies of itself, then kills its host?
[1]

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.


Scroll to the Top
....
My Preferences
....
Communicating with server
Loading
Please Wait...
....
Loading
 X 
....