Signature Detail

WORM: SDBot.DX Infected Host IRC Beacon

This signature detects the DX variant of the SDBot Worm/Trojan connecting to an IRC server (to report that the Trojan is available). Because this activity indicates that the sending host is infected, you should take appropriate security measures immediately.

Extended Description

SDBot-DX is a worm that infects Windows operating systems. It attempts to spread through Windows default administrative shares.

References

• URL: http://vil.nai.com/vil/content/v_100454.htm
• URL: http://securityresponse.symantec.com/avcenter/venc/data/backdoor.sdbot.y.html
• URL: http://www.sophos.com/virusinfo/analyses/w32sdbotbc.html