W32/Sdbot-SQ

Please follow the instructions for removing worms.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

and remove any reference to any file you deleted.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\

and remove any reference to any file you deleted.

Close the registry editor.

W32/Sdbot-SQ is a network worm and backdoor for the Windows platform. The worm spreads to shared folders with weak passwords.

The backdoor component connects to a predefined IRC server and waits for commands from a remote attacker.

The backdoor component allows a remote attacker to:

• transfer files to and from the infected computer
• use the infected computer as a proxy server
• launch distributed denial-of-service attacks

When run W32/Sdbot-SQ copies itself to the Windows system folder as sdrss.exe. The worm ensures that the copy is run each time Windows starts by adding the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
sdrss
sdrss.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
sdrss
sdrss.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
sdrss
sdrss.exe

Sophos's anti-virus products include proactive protection technology, which can defend against new threats without requiring an update. Sophos customers have been protected against W32/Sdbot-SQ (detected as Sdbot-Fam) since version 3.85.