high
Summary
Summary
Action- More Information
| Protection available since | 2 July 2004 10:50:07 (GMT) |
|---|---|
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Sdbot-JJ is a network worm with backdoor capabilities which allows a remote intruder to access and control the computer via IRC channels.
W32/Sdbot-JJ spreads over a network by copying itself to the Windows system folder of C$ and Admin$ shares with weak passwords.
Each time the worm is run it tries to connect to a remote IRC server and join a specific channel. The worm then runs in the background as a server process listening for commands to execute.
When first run the worm copies itself to the Windows system folder as MSGFIX16.EXE and creates the following registry entries so that the worm runs when Windows starts up:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Messenger Fix = msgfix16.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Messenger Fix = msgfix16.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Messenger Fix = msgfix16.exe
W32/Sdbot-JJ collects CD keys of popular games that are installed on the computer.
|
