Sdbot.add is a dangerous widely spread worm that propagates mostly through unprotected network shares found on a local network. Once executed, the parasite drops a rootkit that allows the remote intruder to break into the infected system. Sdbot.add also runs a backdoor controlled through the IRC network. This backdoor gives the attacker unauthorized remote access to a compromised computer and allows to control it. Sdbot.add secretly runs on every Windows startup.