W32/Sdbot-DNL is a Trojan for the Windows platform.
W32/Sdbot-DNL runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
W32/Sdbot-DNL is installed the following files are created:
<Temp>\ixp000.tmp\binary.exe - detected as Troj/Virtum-Gen
<Temp>\ixp000.tmp\setup.exe - detected as W32/Sdbot-DNL
<System>\wauclt.exe - detected as W32/Sdbot-DNL
The following registry entry is created to run wauclt.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Generic Host
wauclt.exe