high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 10 November 2005 03:04:14 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Sdbot-CNW is a network worm with backdoor Trojan functionality for the Windows platform.
The worm spreads through network shares protected by weak passwords, MS-SQL servers and through various operating system vulnerabilities.
W32/Sdbot-CNW connects to a predetermined IRC channel and awaits further commands from remote users. The backdoor component of W32/Sdbot-CNW can be instructed to perform the following functions:
scan networks for vulnerabilities
download/execute arbitrary files
start an ftp server
W32/Sdbot-CNW will drop the a file to the Windows system folder as msdirectx.sys. This file is detected as Troj/NtRootK-F.
When first run, W32/Sdbot-CNW copies itself to the Windows system folder as ntdat32.exe and creates the following registry entries in order to run each time a user logs on:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Compaq Service Drivers
"ntdat32.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Compaq Service Drivers
"ntdat32.exe"
HKLM\SOFTWARE\Microsoft\Ole
Compaq Service Drivers
"ntdat32.exe"
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Compaq Service Drivers
"ntdat32.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Compaq Service Drivers
"ntdat32.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Compaq Service Drivers
"ntdat32.exe"
HKCU\SYSTEM\CurrentControlSet\Control\Lsa
Compaq Service Drivers
"ntdat32.exe"
HKCU\Software\Microsoft\Ole
Compaq Service Drivers
"ntdat32.exe"
|
