W32/Sdbot-GO is a backdoor Trojan and network-aware worm which runs in the background as a service process and allows unauthorised remote access to the computer via IRC channels.
W32/Sdbot-GO copies itself to the Windows system folder as dosin.exe and creates the following registry entry so that the Trojan is run when a user logs on to Windows:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Auto Start
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Auto Start
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\Auto Start
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Auto Start
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\Auto Start
W32/Sdbot-GO remains resident, listening for commands from remote users. If the appropriate commands are received the Worm will begin scanning the internet for network shares with weak administrator passwords and will attempt to copy itself to these shares.