Important facts so far:
- Patch MS05-039 will protect you
- Windows XP SP2 and Windows 2003 can not be exploited by this worm, as the worm does not use a valid logon.
- Blocking port 445 will protect you (but watch for internal infected systems)
- The FTP server does not run on port 21. It appears to pick a random high port.

NEW YORK --A computer worm emerged to strike machines running flawed versions of Microsoft Corp.'s (MSFT) Windows just five days after the software giant disclosed a "critical" vulnerability in the operating system and urged customers to patch their systems.
  The worm, dubbed "Zotob" by security software makers, appeared in two variants on Sunday. While neither variant is currently widespread, the speed at which malicious attackers launched a worm was notable. Moreover, attackers are likely to release improved attacks, if the past is a guide.
  Zotob moves directly between computers through Internet Relay Chat servers, rather than using email to spread. Security-software company Symantec Corp. (SYMC) rated both variants low risk and said the worm's spread was hindered because it moves easily only among machines running Windows 2000.
  "Regardless, users are urged to patch their systems to protect against this and future variants," said Oliver Friedrichs, senior manager at Symantec Security Response, in an emailed statement.
  Microsoft began offering patches for the programming flaw that Zotob exploits on Tuesday. The error is in Windows' Plug and Play service, which handles the installation and configuration of external devices. A successful attack can provide complete control over affected computers, allowing attackers to install other malicious programs, steal confidential information and burrow further into corporate networks.
  The Windows 2000, XP or Server 2003 operating systems are vulnerable to attack, but a default requirement for users of Windows XP and Server 2003 to authenticate themselves is limiting infections, Symantec said. The worm is able to use computers running Windows 95, 98, Me and NT4 to spread to other computers, but it cannot actually infect these machines.
  The Plug and Play flaw was discovered by researchers at Internet Security Systems Inc. (ISSX). The company said on Tuesday when it announced its findings that the flaw was trivial to exploit and that its researchers were aware of three publicly available hacker programs designed to exploit the flaw.

A computer worm emerged to strike machines running flawed versions of Microsoft Corp.'s (MSFT) Windows

The hackers who unleashed Mytob and Zotob may be behind bars, but variants of their work continue to appear.

Security firm MessageLabs says it has detected a new variant of the Mytob worm and intercepted 72 copies since early Wednesday.

While similar to previous Mytob variants, the latest worm appears to have been compiled using more recent code than that used by its creator, the hacker known as Diabl0, according to MessageLabs.