SDBot-UH Worm with a Network Sniffing Kicker

The struggle against the virus writers continues to also be a battle of innovation. While we are attempting to keep our signatures updated and create better prevention and detection techniques, the other side is being just as persistent. One of their latest pieces of work is a variant of the SDBot worm series called: SDBot-UH

This jewel has a network sniffer, improved backdoor access, and a doggon keystroke logger. It appears that once infected, the deviant will be able to reap user names and pwds like never before. And of course it possess all the other traits of a worm.

Additional info: here

The good news

Quote:

---

So far there are no reports of SDBot-UH in the wild

---

cheers

I believe I've heard it's based on old windows exploits,thus rendering it not quite as potentially harmful as it could've been...all the same..definitely worrying though..just a small point..I thought the purpose of spreading viruses was to wreak havoc over networks...slow them down..render them useless...now...if one person was spreading this...what'd he want with so much info(agreed there might be credit card numbers etc) but wouldnt it also lead back to him somehow in some way?

This particular critter’s origins are believed to be Russian and a few of its alias were: Backdoor.SdBot.gen (AVP), Backdoor/IRC.SdBot (RAV), Mindjail. The first appearance was as IRC-Sdbot. It was considered a Trojan and over time obviously it has been tweaked and now is a auto-propagating worm. It still retains the backdoor access capabilities and additionally it does use well known window’s exploits to infect.

cheers

heh. yeah sdbot has been around for ages.. gawd, there are SO many variations of it.
I cleaned a box the other day with some 20+ instances of the S version.. and a few of of a version (GH?) that didn't even show up (but were detected) on lists at some av vendors.