Sophos

W32/Sdbot-XB

Aliases
  • Win32.Agobot.aau
  • W32/Sdbot.worm.gen.j
  • W32.Spybot.Worm
Category
Type
What to do
Prevalence low high

Summary

 
How it spreads
  • Network shares
Characteristics
  • Drops more malware
  • Installs itself in the registry
Protection available since 14 April 2005 20:36:49 (GMT)
Detected by All Sophos products
Download Free virus scan
Download the Threat Detection Test
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

W32/Sdbot-XB is a worm which attempts to spread to remote network shares. It also contains backdoor functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.

W32/Sdbot-XB copies itself to the Windows system folder as taskbarmngr.exe and creates entries in the registry at the following locations to run itself on system startup:

HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_WTASKBARMNGR\0000\
Service
wtaskbarmngr

HKLM\SYSTEM\ControlSet001\Services\wtaskbarmngr\
ImagePath
C:\WINDOWS\taskbarmngr.exe

HKLM\SYSTEM\ControlSet001\Services\wtaskbarmngr\
DisplayName
Windows Taskbar Manager

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WTASKBARMNGR\0000\
Service
wtaskbarmngr

HKLM\SYSTEM\CurrentControlSet\Services\wtaskbarmngr\
ImagePath
C:\WINDOWS\taskbarmngr.exe

HKLM\SYSTEM\CurrentControlSet\Services\wtaskbarmngr\
DisplayName
Windows Taskbar Manager

HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_WTASKBARMNGR\0000\Control\
ActiveService
wtaskbarmngr

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WTASKBARMNGR\0000\
Control\ActiveService
wtaskbarmngr

W32/Sdbot-XB may try to disable firewall and Anti-Virus products.

W32/Sdbot-XB also drops Troj/Rootkit-U as "haxdrv.sys" to the windows system folder.

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer