This sdbot variant has been spreading around Undernet and is a combination
of the msblast worm, sdbot and spybot. It installs as a service and
triggers WFP which I think was a mistake. Termination of the process
causes an immediate reboot.

Samples are available here: http://www.moosoft.com/thecleaner/rcpsdbot.zip
password is: infected

Daniel Otis-Vigil
MooSoft Development LLC
http://www.moosoft.com/thecleaner

[ reply ]