high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | July 2005 (3.95) |
| Protection available since | 30 May 2005 18:28:38 (GMT) |
| Last updated | 3 June 2005 22:13:58 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Sdbot-BXQ is a network worm and IRC backdoor Trojan for the Windows platform which allows a remote intruder to access and control the computer via IRC channels.
The backdoor component joins a specific channel on an IRC server and then runs continuously in the background as a service process, listening on the IRC channel for specific commands and carrying out the appropriate actions.
The worm copies itself to a file named msclient32.exe in the Windows system folder and creates the following registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Client for Microsoft Networks
"msclient32.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Client for Microsoft Networks
"msclient32.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Client for Microsoft Networks
"msclient32.exe"
|
