high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Included in our products from | May 2005 (3.93) |
| Protection available since | 29 March 2005 05:40:30 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
More Information
W32/Sdbot-WL is a network worm and IRC backdoor Trojan for the Windows platform which allows a remote intruder to access and control the computer via IRC channels.
The backdoor component joins a specific channel on an IRC server and then runs continuously in the background as a service process, listening on the IRC channel for specific commands and carrying out the appropriate actions.
W32/Sdbot-WL drops the file msdirectx.sys, detected as Troj/NtRootK-F, to the Windows folder.
The worm copies itself to a file named cpqa1000.exe in the Windows system folder and creates the following registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Compaq Print Fax
cpqa1000.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Compaq Print Fax
cpqa1000.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Compaq Print Fax
cpqa1000.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Compaq Print Fax
cpqa1000.exe
HKCU\SYSTEM\CurrentControlSet\Control\Lsa
Compaq Print Fax
cpqa1000.exe
HKCU\Software\Microsoft\OLE
Compaq Print Fax
cpqa1000.exe
HKLM\SOFTWARE\Microsoft\Ole
Compaq Print Fax
cpqa1000.exe
|
