high
Summary
Summary
Action- More Information
| Included in our products from | July 2004 (3.83) |
|---|---|
| Protection available since | 3 June 2004 13:47:48 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please read the instructions for removing W32/Sdbot-IU.
More Information
W32/Sdbot-IU is a worm which attempts to spread to remote network shares. It
also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.
W32/Sdbot-IU copies itself to the Windows system folder as WNETLOGIN.EXE and as COOL.EXE and creates entries in the registry at the following locations
so as to run itself on system startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft System Checkup
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services\
Microsoft System Checkup
W32/Sdbot-IU also sets the following registry entry so as to run a file called
SYSLOG32.EXE on system startup, though no file of that name is dropped
explicitly:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NT Logging Service
W32/Sdbot-IU spreads to network shares with weak passwords as a result of the
backdoor Trojan element receiving the appropriate command from a remote user,
copying itself to the Windows Start Menu startup folder.
W32/Sdbot-IU attempts to clear the Security system log file.
W32/Sdbot-IU attempts to download and execute several files to the Temp folder,
but at the time of writing none of these were available.
W32/Sdbot-IU attempts to terminate and disable various anti-virus and security
related programs and services.
W32/Sdbot-IU also modifies the HOSTS file located at
%WINDOWS%\System32\Drivers\etc\HOSTS, mapping selected anti-virus websites
to the loopback address 127.0.0.1 in an attempt to prevent access to these
sites. Typically the following mappings will be appended to the HOSTS file:
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
|
