W32/Sdbot-UN is a worm with backdoor functionality.
W32/Sdbot-UN may spread to remote network shares with weak passwords.
W32/Sdbot-UN connects to a predetermined IRC channel and runs in the background listening for backdoor commands.
W32/Sdbot-UN is a worm with backdoor functionality.
W32/Sdbot-UN may spread to remote network shares with weak passwords.
W32/Sdbot-UN connects to a predetermined IRC channel and runs in the background listening for backdoor commands.
W32/Sdbot-UN copies itself to the Windows system folder as SDKC55REZZZ2.EXE and creates the following registry entries in order to run itself on system startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SDKz0r
SDKc55rezzz2.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
SDKz0r
SDKc55rezzz2.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
SDKz0r
SDKc55rezzz2.exe