Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

WORM_SDBOT.D

by Marianna Schmudlach Nov 21, 2003 11:11AM PST

Virus type: Worm

Destructive: No

Aliases: Backdoor.SDBot.Gen, Backdoor/SdBot.Server, IRC/BackDoor.SdBot.VW

Description:

This memory-resident worm propagates via network shares by generating random IP addresses, and arrives as a dropped file in the root directory of a target system.

It also has backdoor capabilities.

It opens port 139, and connects to an Internet Relay Chat (IRC) channel to wait for the following commands from a remote malicious user:

Perform a Denial of Service (DoS) attack against a target host
Retrieve system information
Connect to a URL
Upload and download files
Execute programs
This UPX-compressed worm runs on Windows 95, 98, ME, NT, 2000, and XP.

More: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SDBOT.D