W32/Sdbot-DIC

Please follow the instructions for removing worms.

W32/Sdbot-DIC is a network worm with backdoor Trojan functionality for the Windows platform.

The worm spreads through network shares protected by weak passwords, MS-SQL servers, AOL Instant Messenger (AIM) and through various operating system vulnerabilities such as ASN.1 (MS04-007).

W32/Sdbot-DIC connects to a predetermined IRC channel and awaits further commands from remote users. W32/Sdbot-DIC is a network worm with backdoor Trojan functionality for the Windows platform.

When first run, W32/Sdbot-DIC copies itself to the Windows system folder as taskdrv32.exe and modifies the following registry entry in order to run each time an EXE file is run:

HKCR\exefile\shell\open\command
(default)
taskdrv32.exe \"%1\" %*

The worm spreads through network shares protected by weak passwords, MS-SQL servers, AOL Instant Messenger (AIM) and through various operating system vulnerabilities such as ASN.1 (MS04-007).

W32/Sdbot-DIC connects to a predetermined IRC channel and awaits further commands from remote users. The backdoor component of W32/Sdbot-DIC can be instructed to perform the following functions:

scan networks for vulnerabilities
download/execute arbitrary files
start an ftp server
terminate anti-virus and security related processes
take part in distributed denial of service (DDoS) attacks
steal usernames and passwords

W32/Sdbot-DIC also spreads via peer to peer (P2P) applications by creating copies of itself in shared folders.

W32/Sdbot-DIC modifies the HOSTS file (typically located in <Windows system folder>\drivers\etc) by mapping the following domains to randomly generated IP addresses:

avp.com
ca.com
customer.symantec.com
dispatch.mcafee.com
download.mcafee.com
downloads-eu1.kaspersky-labs.com
downloads-eu2.kaspersky-labs.com
downloads-eu3.kaspersky-labs.com
downloads-eu4.kaspersky-labs.com
downloads-us1.kaspersky-labs.com
downloads-us2.kaspersky-labs.com
downloads-us3.kaspersky-labs.com
downloads-us4.kaspersky-labs.com
downloads1.kaspersky-labs.com
downloads2.kaspersky-labs.com
downloads3.kaspersky-labs.com
downloads4.kaspersky-labs.com
f-secure.com
ftp.avp.com
ftp.ca.com
ftp.customer.symantec.com
ftp.dispatch.mcafee.com
ftp.download.mcafee.com
ftp.downloads-eu1.kaspersky-labs.com
ftp.downloads-eu2.kaspersky-labs.com
ftp.downloads-eu3.kaspersky-labs.com
ftp.downloads-eu4.kaspersky-labs.com
ftp.downloads-us1.kaspersky-labs.com
ftp.downloads-us2.kaspersky-labs.com
ftp.downloads-us3.kaspersky-labs.com
ftp.downloads-us4.kaspersky-labs.com
ftp.downloads1.kaspersky-labs.com
ftp.downloads2.kaspersky-labs.com
ftp.downloads3.kaspersky-labs.com
ftp.downloads4.kaspersky-labs.com
ftp.f-secure.com
ftp.grisoft.com
ftp.kaspersky-labs.com
ftp.kaspersky.com
ftp.liveupdate.symantec.com
ftp.liveupdate.symantecliveupdate.com
ftp.mast.mcafee.com
ftp.mcafee.com
ftp.my-etrust.com
ftp.nai.com
ftp.networkassociates.com
ftp.norton.com
ftp.rads.mcafee.com
ftp.sandbox.norman.com
ftp.secure.nai.com
ftp.securityresponse.symantec.com
ftp.sophos.com
ftp.symantec.com
ftp.symantecliveupdate.com
ftp.symatec.com
ftp.trendmicro.com
ftp.uk.trendmicro-europe.com
ftp.update.symantec.com
ftp.updates.symantec.com
ftp.updates1.kaspersky-labs.com
ftp.updates2.kaspersky-labs.com
ftp.updates3.kaspersky-labs.com
ftp.updates4.kaspersky-labs.com
ftp.us.mcafee.com
ftp.viruslist.com
grisoft.com
kaspersky-labs.com
kaspersky.com
liveupdate.symantec.com
liveupdate.symantecliveupdate.com
mast.mcafee.com
mcafee.com
my-etrust.com
nai.com
networkassociates.com
norton.com
pandasoftware.com
rads.mcafee.com
sandbox.norman.com
secure.nai.com
securityresponse.symantec.com
sophos.com
symantec.com
symantecliveupdate.com
symatec.com
trendmicro.com
uk.trendmicro-europe.com
update.symantec.com
updates.symantec.com
updates1.kaspersky-labs.com
updates2.kaspersky-labs.com
updates3.kaspersky-labs.com
updates4.kaspersky-labs.com
us.mcafee.com
viruslist.com
virusscan.jotti.org
virustotal.com
www.avp.com
www.ca.com
www.customer.symantec.com
www.dispatch.mcafee.com
www.download.mcafee.com
www.downloads-eu1.kaspersky-labs.com
www.downloads-eu2.kaspersky-labs.com
www.downloads-eu3.kaspersky-labs.com
www.downloads-eu4.kaspersky-labs.com
www.downloads-us1.kaspersky-labs.com
www.downloads-us2.kaspersky-labs.com
www.downloads-us3.kaspersky-labs.com
www.downloads-us4.kaspersky-labs.com
www.downloads1.kaspersky-labs.com
www.downloads2.kaspersky-labs.com
www.downloads3.kaspersky-labs.com
www.downloads4.kaspersky-labs.com
www.f-secure.com
www.grisoft.com
www.kaspersky-labs.com
www.kaspersky.com
www.liveupdate.symantec.com
www.liveupdate.symantecliveupdate.com
www.mast.mcafee.com
www.mcafee.com
www.my-etrust.com
www.nai.com
www.networkassociates.com
www.norton.com
www.pandasoftware.com
www.rads.mcafee.com
www.sandbox.norman.com
www.secure.nai.com
www.securityresponse.symantec.com
www.sophos.com
www.symantec.com
www.symantecliveupdate.com
www.symatec.com
www.trendmicro.com
www.uk.trendmicro-europe.com
www.update.symantec.com
www.updates.symantec.com
www.updates1.kaspersky-labs.com
www.updates2.kaspersky-labs.com
www.updates3.kaspersky-labs.com
www.updates4.kaspersky-labs.com
www.us.mcafee.com
www.viruslist.com
www.virustotal.com

W32/Sdbot-DIC attempts to terminate the following services and processes:

_avpcc.exe
_avpm.exe
ackwin32.exe
advxdwin.exe
agentsvr.exe
agv.exe
ahnsd.exe
alertsvc.exe
alogserv.exe
amon.exe
amon9x.exe
amonavp32.exe
antivir.exe
antivirus.exe
ants.exe
antssircam.exe
apimonitor.exe
aplica32.exe
apvxdwin.exe
atcon.exe
atguard.exe
ats.exe
atscan.exe
atupdater.exe
atwatch.exe
autodown.exe
autotrace.exe
autoupdate.exe
avconsol.exe
ave32.exe
avgcc32.exe
avgctrl.exe
avgserv.exe
avgserv9.exe
avgserv9schedapp.exe
avgw.exe
avkpop.exe
avkserv.exe
avkservice.exe
avkwcl9.exe
avkwctl9.exe
avnt.exe
avp.exe
avp32.exe
avpcc.exe
avpccavpm.exe
avpdos32.exe
avpexec.exe
avpinst.exe
avpm.exe
avpmonitor.exe
avptc.exe
avptc32.exe
avpupd.exe
avpupdates.exe
avrescue.exe
avsched32.exe
avsynmgr.exe
avwin95.exe
avwinnt.exe
avwupd32.exe
avxgui.exe
avxinit.exe
avxlive.exe
avxmonitor9x.exe
avxmonitornt.exe
avxnews.exe
avxquar.exe
avxsch.exe
avxw.exe
backlog.exe
bd_professional.exe
bidef.exe
bidserver.exe
bipcp.exe
bisp.exe
blackd.exe
blackice.exe
blackiceblackd.exe
bootwarn.exe
borg2.exe
bs120.exe
bullguard.exe
ccapp.exe
ccevtmgr.exe
ccimscan.exe
ccpwdsrc.exe
ccpxysvc.exe
ccsetmgr.exe
cdp.exe
cfiadmin.exe
cfiaudit.exe
cfinet.exe
cfinet32.exe
claw95.exe
claw95cf.exe
clean.exe
cleaner.exe
cleaner3.exe
cleanpc.exe
cmgrdian.exe
cmon016.exe
codered.exe
connectionmonitor.exe
conseal.exe
cpd.exe
cpf9x206.exe
ctrl.exe
defalert.exe
defence.exe
defense.exe
defscangui.exe
defwatch.exe
deputy.exe
doors.exe
dpf.exe
drwatson.exe
drweb32.exe
dvp95.exe
dvp95_0.exe
ecengine.exe
edisk.exe
efpeadm.exe
esafe.exe
escanh95.exe
escanhnt.exe
escanv95.exe
espwatch.exe
etrustcipe.exe
evpn.exe
expert.exe
fameh32.exe
fast.exe
fch32.exe
fih32.exe
findviru.exe
firewall.exe
fix-it.exe
flowprotector.exe
fnrb32.exe
fprot.exe
frw.exe
fsaa.exe
fsav32.exe
fsav95.exe
fsave32.exe
fsgk32.exe
fsm32.exe
fsma32.exe
fsmb32.exe
fwenc.exe
gbmenu.exe
gbpoll.exe
gedit.exe
generics.exe
grief3878.exe
guard.exe
guarddog.exe
hackereliminator.exe
hh.exe
hijackthis.exe
iamapp.exe
iamserv.exe
iamstats.exe
ibmasn.exe
ibmavsp.exe
icload95.exe
icloadnt.exe
icmon.exe
icsupp95.exe
icsuppnt.exe
iface.exe
ifw2000.exe
inoculateit.exe
iomon98.exe
iparmor.exe
iris.exe
isrv95.exe
jammer.exe
jedi.exe
kav.exe
kavpf.exe
kavsvc.exe
ldnetmon.exe
ldpromenu.exe
ldscan.exe
localnet.exe
lockdown.exe
lockdown2000.exe
lookout.exe
luall.exe
lucomserver.exe
luspt.exe
mcafee.exe
mcagent.exe
mcmnhdlr.exe
mcshield.exe
mcshieldvvstat.exe
mctool.exe
mcupdate.exe
mcvsrte.exe
mcvsshld.exe
mgavrtcl.exe
mgavrte.exe
mghtml.exe
mgui.exe
minilog.exe
mon.exe
monitor.exe
monsys32.exe
monsysnt.exe
moolive.exe
mpfservice.exe
mpftray.exe
mrflux.exe
msconfig.exe
msinfo32.exe
mwatch.exe
mxtask.exe
n32scanw.exe
nav.exe
nav32.exe
navalert.exe
navap.exe
navapsvc.exe
navapw32.exe
navdx.exe
navengnavex15.exe
navlu32.exe
navnt.exe
navrunr.exe
navstub.exe
navw32.exe
navwnt.exe
nc2000.exe
ndd32.exe
neomonitor.exe
neowatchlog.exe
net2000.exe
netarmor.exe
netcommando.exe
netinfo.exe
netmon.exe
netpro.exe
netprotect.exe
netscanpro.exe
netstat.exe
netutils.exe
netutils].exe
nimda.exe
nisserv.exe
nisum.exe
nisumnisservnisum.exe
nmain.exe
nod32.exe
norman.exe
norman_32.exe
norman_av.exe
norman32.exe
normanav.exe
normist.exe
norton.exe
norton_av.exe
nortonav.exe
notstart.exe
npfmessenger.exe
npfw.exe
npfw32.exe
nprotect.exe
npscheck.exe
npssvc.exe
nresq32.exe
nsched32.exe
nschednt.exe
nsplugin.exe
ntrtscan.exe
ntvdm.exe
ntxconfig.exe
nui.exe
nupgrade.exe
nvarch16.exe
nvc95.exe
nvsvc32.exe
nwservice.exe
nwtool16.exe
offguard.exe
opscan.exe
ostronet.exe
outpost.exe
padmin.exe
panda.exe
pandaav.exe
panixk.exe
pav.exe
pavcl.exe
pavproxy.exe
pavsched.exe
pavw.exe
pccclient.exe
pccguide.exe
pcciomon.exe
pccntmon.exe
pccwin97.exe
pccwin98.exe
pcfwallicon.exe
pcscan.exe
periscope.exe
persfw.exe
pf2.exe
pfwadmin.exe
pingscan.exe
platin.exe
pop3trap.exe
poproxy.exe
portdetective.exe
portmonitor.exe
ppinupdt.exe
pptbc.exe
ppvstop.exe
procdump.exe
processmonitor.exe
processmonitor.exe
procexplorerv10#.exe
programauditor.exe
proport.exe
protectx.exe
pspf.exe
purge.exe
pview95.exe
pw32.exe
qconsole.exe
rav.exe
rav7.exe
rav7win.exe
realmon.exe
regedit32.exe
regrun2.exe
rescue.exe
rrguard.exe
rshell.exe
rtvscn95.exe
rulaunch.exe
safeweb.exe
savscan.exe
sbserv.exe
sbservice.exe
scan.exe
scan32.exe
scan95.exe
scanpm.exe
scrscan.exe
sd.exe
sens.exe
serv95.exe
sfc.exe
sh.exe
sharedaccess.exe
shn.exe
smc.exe
sofi.exe
sophos.exe
sophos_av.exe
sophosav.exe
spf.exe
sphinx.exe
spy.exe
spygate.exe
spyx.exe
spyxx.exe
srwatch.exe
ss3edit.exe
st2.exe
supftrl.exe
supp95.exe
supporter5.exe
sweep95.exe
sweepnet.exe
sweepsrv.sys.exe
sweepsrv.sysvshwin32.exe
swnetsup.exe
symantec.exe
symlcsvc.exe
symproxysvc.exe
symtray.exe
sysedit.exe
taskmon.exe
taumon.exe
tauscan.exe
tbscan.exe
tc.exe
tca.exe
tcm.exe
tctca.exe
tfak.exe
tfak5.exe
tgbob.exe
titanin.exe
titaninxp.exe
trendmicro.exe
trjscan.exe
trojantrap3.exe
truevector.exe
undoboot.exe
update.exe
vbcmserv.exe
vbcons.exe
vbust.exe
vbwin9x.exe
vbwinntw.exe
vccmserv.exe
vcontrol.exe
vet32.exe
vet95.exe
vettray.exe
virus.exe
virusmdpersonalfirewall.exe
vnlan300.exe
vnpc3000.exe
vpc32.exe
vpfw30s.exe
vptray.exe
vscan40.exe
vsched.exe
vsecomr.exe
vshwin32.exe
vshwin32vbcmserv.exe
vsmain.exe
vsmon.exe
vsstat.exe
vswin9xe.exe
vswinntse.exe
w9x.exe
watchdog.exe
webscanx.exe
webtrap.exe
wfindv32.exe
wgfe95.exe
whoswatchingme.exe
wimmun32.exe
Windows Firewall
Windows Security Center
Windows Update
winrecon.exe
winroute.exe
winsfcm.exe
wnt.exe
wqkmm3878.exe
wradmin.exe
wrctrl.exe
wsbgate.exe
wyvernworksfirewall.exe
zapro.exe
zatutor.exe
zauinst.exe
zonalm2601.exe
zonealarm.exe

When spreading via P2P, W32/Sdbot-DIC uses the following filenames:

2 Find MP3 8.2.0.exe
2pac - tupac full album battle before his dead.exe
Adobe InDesign CS 2.exe
Adobe keygen for photoshop indesign incopy SERIAL crack.exe
Adobe Photoshop CS 2.exe
Autocad 2002 Crack.exe
Autocad 2004 Crack.exe
Autocad 2005 Crack.exe
Autocad 2006 Crack.exe
BEST HACK TOOL FOR REAL HACKERS KEYLOGGER WEBCAM SPY! - PRIVATE.exe
Counter strike - cs full version.exe
Counter strike keygen WORKING FOR ONLINE STEAM.exe
credit card generator.exe
Fifa 2006 FULL with crack.exe
Fifa 2007 FULL with crack.exe
flash 8.exe
Free SMS Bomber.exe
Google hack tutorial for beginners.exe
HalfLife 2 WORKING Steam crack.exe
Hotmail account hacker in 30 minutes.exe
Hotmail hacker.exe
hotmail_account_sniffer.exe
Hotmailhacker v1.0.exe
IP Changer.exe
Microsoft Office Activation Crack.exe
Microsoft Office Professional Crack.exe
Microsoft Office Professional Serial.exe
Microsoft Office Professional Universal Crack without serial.exe
Microsoft Office Universal Activator v1.0.exe
MSN hacker - password stealer.exe
norton anti virus FULL NEWEST VERSION.exe
Norton AntiVirus 2005 crack.exe
Norton AntiVirus 2006 crack.exe
Norton antivirus crack.exe
Norton firewall 2006 crack.exe
porn.exe
porn_account_cracker.exe
porn_account_hacker.exe
psx2 - playstation 2 emulator.exe
toon boom.exe
UniVersal GSM unlocker for removing simlock (NOKIA,ERICSSON,SONY,SAMSUNG,OTHERS).exe
WinRAR 4 beta.exe
yahoo_cracker.exe
yahoo_hacker.exe
Yahoo_mail_cracker.exe
ZoneAlarm crack (keygen).exe