Virus writers have created a worm that spreads using a Microsoft Plug-and-Play vulnerability disclosed only last week. The ZoTob worm exploits a security weakness detailed just five days prior to its arrival last weekend.

Two variants of ZoTob have been discovered so far. Each allows hackers to seize control of vulnerable PCs. Both share many similarities with the earlier MyTob worm, according to Finnish anti-virus firm F-Secure, which reckons the malware is based on exploit code published by 'houseofdabus' four days ago.

The spread of ZoTob provokes comparisons with the infamous Sasser worm even though it's nothing like as aggressive. Sasser was released just two days after the same hacker released exploit code for the infamous LSASS vulnerability that underpined Sasser.

F-Secure notes that ZoTob fails to infect Windows XP SP2 machines. It also won't infect machines that block the port via which it spreads (445/TCP) either, further limiting the scope for infection. Windows users (particularly those running Windows 2K, the most vulnerable platform) are urged to apply Microsoft patches lest they get infected. The vulnerability was discovered by ISS. Security firm eEye has released a free scanning tool here. ®