Sadmind is a worm, that propagates from a Sun Solaris machine to another. It also compromises Windows NT/2000 servers running Internet Information Server 4.0 or 5.0.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Variant:Sadmind.A
The worm uses an old vulnerability in the Solaris operating system to enter the system. In the system it first opens remote shell (rsh) service for the root user. It then extracts itself to "/dev/cuc" directory, and adds a worm startup code to the "/etc/rc2.d/S71rpc". The worm also attempts to download and install Perl on the system, and starts itself by executing "/dev/cuc/start.sh" on the victim using the rsh service.
"start.sh" creates a directory "/dev/cup", and starts worms main processes in the background.
The worm goes through random Class-B subnets looking for unpatched Windows NT/2000 machines running IIS web server. If a vulnerable machine is found, the worm will copy the "\winnt\system32\cmd.exe" to "wwwroot\scripts\root.exe" directory and replace "index.htm", "index.asp", "default.htm" and "default.asp" files with its own.
Sadmind also looks for vulnerable Solaris systems from randon Class-B networks. If a vulnerable host is found, the worm creates a tar archive "uni.tar" out of itself, and sends it to the victim using rsh service.
Both vulnerabilities have been fixed by vendors.
Futher information about the problem and the fix in sandmind service in Solaris is available from Sun: https://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/191&...
Further information about the IIS unicode vulnerability, including a fix, is available from Microsoft at: https://www.microsoft.com/technet/security/bulletin/MS00-078.asp and additional information at: https://www.microsoft.com/technet/security/bulletin/MS00-086.asp