W32/Sdbot-VP

Category: Viruses and Spyware
Type: Win32 worm
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

W32/Sdbot-VP is a network worm with backdoor Trojan functionality for the Windows platform.

When first run, W32/Sdbot-VP copies itself to the Windows system folder as apphost.exe and creates the following registry entries in order to run each time a user logs on:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Configuration
"apphost.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Configuration
"apphost.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Configuration
"apphost.exe"

The worm spreads through network shares protected by weak passwords, MS-SQL servers and through various operating system vulnerabilities.

W32/Sdbot-VP connects to a predetermined IRC channel and awaits further commands from remote users. The backdoor component of W32/Sdbot-VP can be instructed to perform the following functions:

scan networks for vulnerabilities
download/execute arbitrary files
start an ftp server

Patches for the vulnerabilities exploited by W32/Sdbot-VP can be obtained from Microsoft at:

MS02-039
MS04-011
MS04-012