W32/Sdbot-SI

Please follow the instructions for removing worms.

Change any data that may have become compromised.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

and remove any reference to any file you deleted.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\

and remove any reference to any file you deleted.

Close the registry editor.

W32/Sdbot-SI is a network worm and backdoor for the Windows platform. The worm spreads to shared folders with weak passwords.

When first run W32/Sdbot-SI copies itself to the Windows system folder as ffasd.exe.

The backdoor component allows a remote attacker to:

• transfer files to and from the infected computer
• steal CD keys for certain game software
• use the infected computer as a proxy server
• launch distributed denial-of-service attacks
• send email

W32/Sdbot-SI spreads through network shares protected by weak passwords. The worm uses the filename vvczsd.exe when spreading through network shares. W32/Sdbot-SI is a network worm and backdoor for the Windows platform. The worm spreads to shared folders with weak passwords.

The backdoor component connects to a predefined IRC server and waits for commands from a remote attacker.

When first run W32/Sdbot-SI copies itself to the Windows system folder as ffasd.exe and creates the following registry entries in order to run each time a user logs on:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SAvasddwq
ffasd.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
SAvasddwq
ffasd.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
SAvasddwq
ffasd.exe

The backdoor component allows a remote attacker to:

• transfer files to and from the infected computer
• steal CD keys for certain game software
• use the infected computer as a proxy server
• launch distributed denial-of-service attacks
• send email

W32/Sdbot-SI spreads through network shares protected by weak passwords. The worm uses the filename vvczsd.exe when spreading through network shares.