W32/Sdbot-UL

Please follow the instructions for removing worms.

To renable DCOM you can edit the registry, but it's better to use Dcomcnfg.exe. See Microsoft article 825750 for details.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

and remove any reference to any file you deleted.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\

and remove any reference to any file you deleted.

Close the registry editor.

W32/Sdbot-UL is a member of the W32/Sdbot family of network worms. The worm can spread to weakly protected network shares. The worm will attempt to spread to the following network shares:

C$
D$
E$
IPC$
PRINT$
ADMIN$
ADMIN$\system32
C$\shared
C$\winnt\system32
C$\windows\system32
C$\Documents and Settings\All Users\Documents\

In order to run automatically when Windows starts up the worm copies itself to the Windows system folder as iexplore.exe and creates the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Internet Explorer Configuration
IEXPLORE.EXE

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Internet Explorer Configuration
IEXPLORE.EXE

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Internet Explorer Configuration
IEXPLORE.EXE

Once installed, W32/Sdbot-UL connects to a preconfigured IRC server and joins a channel from which an attacker can issue further commands. These commands can cause the infected computer to perform any of the following actions:

Send emails as specified by the remote user
Flood a remote host using a SYN flood
Scan for computers to spread to
Run programs
Upload and download files
Secure and unsecure the computer from further infection

If the worm is instructed to secure the computer, it will attempt to delete C$, D$, IPC$ and ADMIN$ network shares and set the following registry entry to disable DCOM:

HKLM\Software\Microsoft\OLE
EnableDCOM
N