W32/Sdbot-LR is a network worm for the Windows platform. W32/Sdbot-LR allows a malicious user remote access to an infected computer through the IRC network.
When run the worm copies itself into the Windows system folder with the name mstcpip.exe and continues execution from this file.
In order to run automatically when Windows starts up W32/Sdbot-LR creates the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
TCPIP Protocol=mstcpip.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
TCPIP Protocol=mstcpip.exe
Each time W32/Sdbot-LR is run it attempts to connect to a remote IRC server and join a specific channel. The worm then runs in the background allowing a remote intruder to issue commands which control the computer.