W32/Sdbot-VQ is a network worm and IRC backdoor Trojan for the Windows platform.
When first run W32/Sdbot-VQ copies itself to the Windows system folder as scvhvst.exe. W32/Sdbot-VQ creates the following registry entries in order to run on user logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Office Studio
scvhvst.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Office Studio
scvhvst.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Office Studio
scvhvst.exe
The worm spreads through network shares protected by weak passwords.
The backdoor component of W32/Sdbot-VQ joins an IRC channel and awaits commands from a remote user. W32/Sdbot-VQ can then be instructed to perform tasks such as:
take part in distributed denial of service (DDoS) attacks
download/execute arbitrary files
scan networks for vulnerabilities
steal product registration keys for certain software
send email