W32/Sdbot-UG

Please follow the instructions for removing worms.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

and remove any reference to any file you deleted.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\

and remove any reference to any file you deleted.

Close the registry editor.

W32/Sdbot-UG is a network worm with backdoor functionality via IRC.

When first run the worm copies itself to the Windows system folder as aqiyutyvo.exe and creates the following registry entries so as to auto-start on computer reboot or user logon:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
epixowu
aqiyutyvo.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
epixowu
aqiyutyvo.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
epixowu
aqiyutyvo.exe

W32/Sdbot-UG will attempt to copy the file ifubek.exe to network shares with weak passwords in the following locations:

\ADMIN$\system32\ifubek.exe
\C$\winnt\system32\ifubek.exe
\IPC$\ifubek.exe
\C$\shared\ifubek.exe
\C$\Documents and Settings\All Users\Documents\ifubek.exe
\C$\windows\system32\ifubek.exe

ifubek.exe is the dropper component of the worm which when run will place hahuwot.exe and kavosojob.exe into the C:\WINNT\SYSTEM32 folder. hahuwot.exe is a copy of the worm and kavosojob.exe is detected by Sophos as Troj/Ranck-CD.

The worm may also download and execute files from the internet and participate in DoS attacks.

Sophos's anti-virus products include proactive protection technology, which can defend against new threats without requiring an update. Sophos customers have been protected against W32/Sdbot-UG (detected as W32/Sdbot-Fam) since version 3.89.