SdBot.vc
Summary
SdBot represents the large family of backdoors - hacker's remote access tools. These tools allow to contol victims' computers remotely by sending specific commands via IRC channels. Also these backdoors can steal data, spread to local network and to computers vulnerable to exploits.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
CAUTION Manual disinfection is a risky process; it is recommended only for advanced users.
Manual disinfection for SdBot.vc backdoor requires renaming of an infected file named WUPDATED.EXE located in Windows System folder and restarting a system.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
-
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
-
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
-
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
The backdoor's file is a PE executable about 71 kilobytes long, packed with Exe32Pack file compressor. The backdoor contains the PSEXEC utility in its body.
When the backdoor's file is started, it copies itself as WUPDATED.EXE file to Windows System folder and then creates the following startup key value in the Registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Configuration Loaded"="WUPDATED.EXE"
The backdoor can also create the following key value:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "Configuration Loaded"="WUPDATED.EXE"
When the backdoor is active, it connects to an IRC server (on port 6667), joins a certain channel and acts as a bot there. The backdoor starts IDENTD server on port 113.
The backdoor tries to contact the following IRC servers:
irc.undernet.org kan3.de
The backdoor joins the following password-protected IRC channels:
#maerchenland #kellyfamily
Here's how the code of the backdoor looks in disassembler's window:
A hacker can send commands to the bots to control infected computers. A hacker can do any of the following:
* perform ping, SYN, ICMP and UDP flood * get system information including information about OS, network and drives * update the backdoor's file from Internet * operate backdoor's bot (nick change, join/part channels, etc.) * redirect traffic on certain ports * open a URL with default web browser * steal CD keys from popular games * spread to computers via LAN (performs dictionary attack on share passwords) * join and spy on certain IRC channels * start remote processes using PSEXEC.EXE utility (extracted from the backdoor) * download and execute files
SdBot.vc steals CD keys for the following games if they are installed on an infected computer:
Half-Life Unreal Tournament 2003 Counter-Strike (Retail) Project IGI 2 Battlefield 1942 Battlefield 1942 Road To Rome Rainbow Six III RavenShield Neverwinter Knights Soldier of Fortune 2 The Gladiators Need for Speed Hot Persuit 2 FIFA 2003 Command & Conquer Generals Red Alert 2 Tiberian Sun