W32/Sdranck-S is a multi-component network worm.
W32/Sdranck-S drops two files in the following locations:
C:\WINNT\SYSTEM32\watchole.exe
C:\WINNT\SYSTEM32\holewatch.exe
WATCHOLE.EXE is a proxy Trojan detected as Troj/Ranck-Fam. HOLEWATCH.EXE is a worm detected as W32/Sdbot-Fam.
The file detected as W32/Sdbot-Fam attempts to spread W32/Sdranck-S to network shares with weak passwords.