W32/Sdbot-XW

Please follow the instructions for removing worms.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

and remove any reference to any file you deleted.

Close the registry editor.

To renable DCOM you can edit the registry, but it's better to use Dcomcnfg.exe. See Microsoft article 825750 for details.

W32/Sdbot-XW is a worm with backdoor Trojan functionality.

The worm may spread by copying itself to remote network shares with weak passwords. The worm contains functionality to download updates, run an FTP server, log keypresses, monitor network traffic and terminate certain processes relating to anti-virus and security products. W32/Sdbot-XW is a worm with backdoor Trojan functionality.

The worm may spread by copying itself to remote network shares with weak passwords. The worm contains functionality to download updates, run an FTP server, log keypresses, monitor network traffic and terminate certain processes relating to anti-virus and security products.

When first run the worm copies itself to the Windows system folder as run.exe.

The following registry entries are created to run run.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Windows =
run.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
Windows =
run.exe

Registry entries are also set as follows:

HKCU\Software\Microsoft\Ole\
Windows =
run.exe

HKLM\Software\Microsoft\Ole\
EnableDCOM =
N