W32/Sdbot.FEL is a worm. The worm will infect Windows systems and spreads through instant messaging applications.

The worm will arrive as a dropped file from the network or visiting malicious websites or downloaded from other malware.

This worm may send any one of the following messages through instant messaging applications.

accepted.
ay no ese pelo fue lo mas chistoso...q estabas pensando
cette vieille image que j'ai trouv e : |
Check out my nice photo album. :D
chten den pics von meinen Ferien sehen?
esa foto de tu y yo la voy a poner en myspace
faut de la reproduction sonore ! regard
faut pic sur le myspace ou quelque chose :D
Haha sollten Sie dieses Ihre R ckstellung auf myspace oder etwas pic bilden:D
haha vous devriez rendre ceci votre d
haha you moet die je standaard foto maken op hyves of myspace
he heb je ooit deze foto laten zien ?
he ich zeige Ihnen diese Abbildung von mir berhaupt?
he werde ich diese Abbildung von uns auf mein myspace setzen
he werde ich diese Abbildung von uns meinem weblog hinzuf
Here are my private pictures for you
Hey i zet deze foto van ons even op mijn myspace
hey i'm going to add this picture of us to my weblog
hey ik voeg deze foto van ons ff toe op mijn weblog
hola esas son las fotos
Io ricordo quando abbiamo portato questa foto Caricher
j'ai fais pour toi ce photo album tu dois le voire :p
jaja debes poner esa foto como foto principal en tu myspace o algo :D
jaja lei dovrebbe fare quest'il suo pic predefinito sul myspace o qualcosa :D
jaja recuerda cuando tuviste el pelo asi
jaja ricordo quando lei aveva i suoi capelli come questo ehi metter
jajaja yo me recuerdo cuando tuvistes el pelo asi
je vais mettre cette image de nous sur mon myspace :>
le lol se rappellent quand vous aviez l'habitude d'avoir vos cheveux comme ceci
lol erinnern sich, an als Sie pflegten, Ihr Haar so zu haben
lol ik kan me nog herrinneren toen je haar zoals dit had
lol remember when you used to have your hair like this
mes photos chaudes :D
metta questi fotos in suo pagina myspace ehi aggiunger
My friend took nice photos of me.you Should see em loL!
Nice new photos of me and my friends and stuff and when i was young lol...
oye ponga esa foto en tu myspace como la foto principal
oye voy a agregar esa foto a mi blog ya
oye voy a poner esa foto de nosotros en mi myspace :->
Per favore nessuno lasciare vede le nostre foto
quest'immagine di noi al mio weblog
quest'immagine di noi sul mio myspace :>
questa foto al mio myspace adesso
Qui sono il fotos di ci
veux tu voir mes image de vacance??
voy a poner esa foto de nosotros en mi blog ya
wanna see the pics from my vacation? :>
wil je fotos zien van mijn vakantie
Wimmern! Blick auf diese alte Abbildung, die ich: fand
wow! moet je eens kijken welke foto ik nu gevonden heb

When the user clicks the link mentioned in the message a copy of this worm gets executed.

Upon execution, the worm copies itself as lsass.exe and IMG-0012.zip in the Windows folder.

The worm modifies registry at the following location to load itself during each startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm also has backdoor capabilities using random port, allowing the remote attacker to get access to the infected computer.

This worm first appeared on September 18, 2007.

 Other names of W32/Sdbot.FEL Worm:

This Worm is also known as WORM_SDBOT.FEL, Backdoor.Win32.SdBot.bxr, W32/Checkout, W32.SillyIM, TR/Crypt.ULPM.Gen, Mal/HckPk-A.