Hello KURT!

09 Jan 05 17:59, you wrote to me:

 KW>> How it spreads
 KW>>     * Network shares

          ^ ^ ^ ^ ^ ^ ^

 KW>> Advanced
 KW>> W32/Sdbot-SW is a worm which attempts to spread to remote network
 KW>> shares. It also contains backdoor Trojan functionality, allowing
 KW>> unauthorised remote access to the infected computer via IRC

                                                              ^ ^ ^ ^

 KW>> channels while running in the background as a service process.

 BS>> Just me or doesn't it makes sense? IRC and local network shares?

 BS>> If it just was spread during network shares, it would be pretty
 BS>> harmless..

 KW> i'm not sure i follow what you're saying...

 KW> it spreads via unprotected (or poorly protected) network shares and
 KW> once it's compromized a system it opens up a backdoor via... what part
 KW> of this doesn't make sense?

See below, is it beeing spread both by network shares and irc channels?

Bo


--- GoldED+/LNX 1.1.5