high
Summary
Summary
Action- More Information
| Included in our products from | July 2004 (3.83) |
|---|---|
| Protection available since | 18 May 2004 15:40:29 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Check your administrator passwords and review network security.
Change any data that may have become compromised.
You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Security Patch = WinUpdate32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Security Patch = WinUpdate32.exe
and delete them if they exist.
Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:
HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\Security Patch = WinUpdate32.exe
and delete it if it exists.
Close the registry editor.
More Information
W32/SdBot-BM is a network worm and a backdoor Trojan which runs in the background as a service process and allows unauthorised remote access to the computer via IRC channels.
When executed W32/SdBot-BM copies itself to the Windows system folder with the filename WinUpdate32.exe and sets the following registry entries with the path to the copy:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Security Patch = WinUpdate32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Security Patch = WinUpdate32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Security Patch = WinUpdate32.exe
W32/SdBot-BM attempts to copy itself to remote network shares with weak passwords.
As a backdoor W32/SdBot-BM can be used to install and execute programs on your computer, retrieve system information and flood other computers with network packets.
The information the worm retrieves includes computer name, user name, operating system, memory size and CD-keys for various games.
|
