high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 7 September 2004 18:10:59 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Please follow the instructions for removing W32/Sdbot-RY.
More Information
W32/Sdbot-RY is a worm and backdoor for the Windows platform.
The worm component attempts to spread to remote network shares and the backdoor allows a malicious user remote access to an infected computer via IRC channels while running in the background as a service process.
W32/Sdbot-RY is a worm and backdoor for the Windows platform.
The worm component attempts to spread to remote network shares and the backdoor allows a malicious user remote access to an infected computer via IRC channels while running in the background as a service process.
W32/Sdbot-RY copies itself to the Windows system folder with the filename spoolsvc.exe and in order to run automatically when Windows starts up creates the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Win32 System Spool=spoolsvc.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Win32 System Spool=spoolsvc.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Win32 System Spool=spoolsvc.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Win32 System Spool=spoolsvc.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Win32 System Spool=spoolsvc.exe.
W32/Sdbot-RY attempts to spread to network machines using various exploits including the LSASS vulnerability (see MS04-011).
W32/Sdbot-RY may function as a proxy server, delete network shares and steal information related to popular games.
|
