Sdbot.AJ is a network-aware worm and Trojan. Spreads in the local network using open shares. Adds the value: "Microsoft Windows Update" = "msnmessenger.exe" to the Windows startup registry keys. Opens a back door on the compromised system by connecting to an IRC server through TCP port 59 on the domain moskemongo.biz. Attempts to spread to the following network shares: * C$ * IPC$ * ADMIN$
Home
