W32/Sdbot-CV

Please follow the instructions for removing worms.

W32/Sdbot-CV is a backdoor Trojan and network aware worm which runs in the background as a service process and allows unauthorised remote access to the computer via IRC channels.

W32/Sdbot-CV copies itself to the Windows System32 folder as WINUPDATE.EXE and creates the following registry entries so that the worm is run when a user logs on to Windows:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Update = WinUpdate.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Update = WinUpdate.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Update = WinUpdate.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Update = WinUpdate.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Update = WinUpdate.exe

W32/Sdbot-CV remains resident, listening for commands from remote users. If the appropriate commands are received the Worm will begin scanning the internet for network shares with weak administrator passwords and will attempt to copy itself to these shares.