The Channel logo


By | John Leyden 31st October 2005 13:55

AOL IM worm roots around Windows PCs

Under the radar

A worm propagating through AOL's Instant Messenger network comes with rootkit technology designed to slip under anti-virus defences. The Sdbot-ADD worm is being passed through instant messages from members on a user’s Buddy List and within AOL chat rooms.

Sdbot-ADD, the latest variant of a family of worms that is continuously modified with new components by hackers, comes complete with an adware bundle and a rootkit file, lockx.exe. "The executable provides an attacker with the capability to upload, download and monitor the infected host. Furthermore, the executable attempts to shut down anti-virus programs and leaves a backdoor on the host PC to install additional software," according to IM security firm FaceTime, which was among the first security firms to notify of the threat.

Rootkits refer to a set of tools used by crackers after breaking into a computer system to hide logins and processes under the control of an attacker from detection. Rootkits have been familiar items of malicious Unix hackers' tool kits for years but more recently the technique has been applied in the creation of types of Windows malware. In this case the lockx.exe rootkit that connects to an IRC server, awaiting remote commands from an attacker.

Sdbot-ADD also changes a surfer’s original search page to and installs various adware applications including 180Solutions, Zango, the Freepod Toolbar, MaxSearch, Media Gateway, and SearchMiracle. Infested machines are likely to slow to a crawl under the weight of all this garbage, FaceTime warns. ®

alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe