Malware type: Worm

Aliases: Backdoor.Win32.IRCBot.ct (Kaspersky), W32/Sdbot.worm.gen.bh (McAfee), Backdoor.Sdbot (Symantec), Worm/SdBot.169545 (Avira), W32/Rbot-Fam (Sophos), Backdoor:Win32/Sdbot (Microsoft)

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 95, 98, ME, NT, 2000, XP

Encrypted: No

Description: 

This worm spreads via the popular instant messaging program, AOL Instant Messenger. It sends the following link to all available AOL contacts it finds in an affected system:

http://SexyFun.{BLOCKED}.net/Images.php?pic=7458&sec=magic

Users are advised to refrain from clicking on the link. Clicking the link downloads the worm onto the system.

This worm drops a file into the Windows system folder detected by Trend Micro as TROJ_ROOTKIT.H.

It also has backdoor capabilities. It connects to an Internet Relay Chat (IRC) server. This enables a remote user to perform malicious commands on the affected machine. The said routine provides remote users virtual control over affected systems, thus compromising system security.

Systems affected by this worm may also be affected by TROJ_STARTPAG.QY.

For additional information about this threat, see:
Solution
Technical Details

Description created: Jul. 19, 2005 10:28:22 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.