Threat description



SdBot represents the large family of backdoors - hacker's remote access tools. These tools allow to contol victims' computers remotely by sending specific commands via IRC channels. Also these backdoors can steal data, spread to local network and to computers vulnerable to exploits.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.

Network Disinfection

For general instructions on disinfecting a local network infection, please see Eliminating A Local Network Outbreak.

Manual Disinfection

Caution: Manual disinfection is a risky process; it is recommended only for advanced users.

Manual disinfection for backdoor requires renaming of an infected file named WUPDATED.EXE located in Windows System folder and restarting a system.

Technical Details

The backdoor's file is a PE executable about 71 kilobytes long, packed with Exe32Pack file compressor. The backdoor contains the PSEXEC utility in its body.

When the backdoor's file is started, it copies itself as WUPDATED.EXE file to Windows System folder and then creates the following startup key value in the Registry:

"Configuration Loaded"="WUPDATED.EXE"

The backdoor can also create the following key value:

"Configuration Loaded"="WUPDATED.EXE"

When the backdoor is active, it connects to an IRC server (on port 6667), joins a certain channel and acts as a bot there. The backdoor starts IDENTD server on port 113.

The backdoor tries to contact the following IRC servers:

The backdoor joins the following password-protected IRC channels:


Here's how the code of the backdoor looks in disassembler's window:

A hacker can send commands to the bots to control infected computers. A hacker can do any of the following:

* perform ping, SYN, ICMP and UDP flood
* get system information including information about OS, network and drives
* update the backdoor's file from Internet
* operate backdoor's bot (nick change, join/part channels, etc.)
* redirect traffic on certain ports
* open a URL with default web browser
* steal CD keys from popular games
* spread to computers via LAN (performs dictionary attack on share passwords)
* join and spy on certain IRC channels
* start remote processes using PSEXEC.EXE utility (extracted from the backdoor)
* download and execute files steals CD keys for the following games if they are installed on an infected computer:

Unreal Tournament 2003
Counter-Strike (Retail)
Project IGI 2
Battlefield 1942
Battlefield 1942 Road To Rome
Rainbow Six III RavenShield
Neverwinter Knights
Soldier of Fortune 2
The Gladiators
Need for Speed Hot Persuit 2
FIFA 2003
Command & Conquer Generals
Red Alert 2
Tiberian Sun

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info