W32/Sdbot-WS

Please follow the instructions for removing worms.

To renable DCOM you can edit the registry, but it's better to use Dcomcnfg.exe. See Microsoft article 825750 for details.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

and remove any reference to any file you deleted.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\

and remove any reference to any file you deleted.

Close the registry editor.

W32/Sdbot-WS is a member of the W32/Sdbot family of network worms. The worm can spread to weakly protected network shares, and to computers already infected with W32/MyDoom.

The worm has a backdoor component that connects to a preconfigured IRC mchannel, allowing an attacker to issue instructions to the worm, thus giving access to an infected computer.

W32/Sdbot-WS can be instructed to harvest product keys; scan for remote computers to infect; upload, download and execute files; as well as retrieve information about an infected system. W32/Sdbot-WS is a member of the W32/Sdbot family of network worms. The worm can spread to weakly protected network shares, and to computers already infected with W32/MyDoom.

In order to run automatically when Windows starts up the worm copies itself to the <System> folder as winupdate.exe and creates the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Windows Update
winupdate.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Windows Update
winupdate.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Windows Update
winupdate.exe

Once installed, W32/Sdbot-WS connects to a preconfigured IRC server and joins a channel from which an attacker can issue further commands. These commands can cause the infected computer to perform any of the following actions:

Scan for remote computers to infect
Steal product keys
Upload, download and execute files
Retrieve information about an infected system

The worm can be instructed to secure an infected computer, and does this by attempting to delete the C$, D$, IPC$ and ADMIN$ network shares, and disable DCOM by setting the following registry entry:

HKLM\Software\Microsoft\OLE
EnableDCOM
N