Malware type: Worm

Aliases: Backdoor.Win32.SdBot.aad (Kaspersky), Generic.dl (McAfee), W32.Spybot.Worm (Symantec), Worm/SdBot.44544.36 (Avira), Mal/Generic-A (Sophos), Backdoor:Win32/Rbot (Microsoft)

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 95, 98, ME, NT, 2000, XP

Encrypted: No

Description: 

Like most SDBOT worms, this variant propagates via network shares. It uses a list of common user names and passwords to access shares that do not have full access rights and drops and executes a copy of itself on successfully accessed shares.

It also exploits the following known Windows security holes:

• Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) vulnerability
• IIS5/WEBDAV Buffer Overrun vulnerability
• Windows LSASS vulnerability

The following Microsoft pages offer more information about these vulnerabilities:

• Microsoft Security Bulletin MS03-026
• Microsoft Security Bulletin MS03-007
• Microsoft Security Bulletin MS04-011

This worm also has backdoor functionalities. It comes with a built-in Internet Relay Chat (IRC) client engine, which enables it to connect to an IRC channel and wait for commands from a malicious user. It processes the commands on the local machine giving remote users virtual control of the infected system.

This worm steals the CD keys of certain game applications. It enables malicious users to launch denial of service (DoS) attacks against target site(s).

This worm runs on Windows 98, ME, NT, 2000, and XP.

For additional information about this threat, see:
Solution
Technical Details

Description created: Sep. 3, 2004 3:52:12 AM GMT -0800
Description updated: Sep. 3, 2004 3:59:26 AM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.