high
Summary
Summary
Action- More Information
| Protection available since | 4 June 2004 13:23:17 (GMT) |
|---|---|
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Sdbot-CV is a backdoor Trojan and network aware worm which runs in the background as a service process and allows unauthorised remote access to the computer via IRC channels.
W32/Sdbot-CV copies itself to the Windows System32 folder as WINUPDATE.EXE and creates the following registry entries so that the worm is run when a user logs on to Windows:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Update = WinUpdate.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Update = WinUpdate.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Update = WinUpdate.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Update = WinUpdate.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Update = WinUpdate.exe
W32/Sdbot-CV remains resident, listening for commands from remote users. If the appropriate commands are received the Worm will begin scanning the internet for network shares with weak administrator passwords and will attempt to copy itself to these shares.
|
