Troj/SDBot-06

Please follow the instructions for removing Trojans.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ctfmon
ctfmon.exe

and delete it if it exists.

Close the registry editor.

Troj/SDBot-06 is a backdoor Trojan which allows a remote user to access and control the computer via IRC channels.

When run, the Trojan will display a false error message box in an attempt to trick the user that the file is damaged.

Troj/SDBot-06 tries to connect to an IRC server and join a specific channel. The Trojan then runs in the background as a server process, listening on the IRC channel for specific commands and carrying out the appropriate actions.

Troj/SDBot-06 will copy itself to the files ctfmon.exe and mirc.dll in the Windows folder along with the config file br.dll. The file 0.0 may also be created but is not malicious and can be safely deleted by the user.

Troj/SDBot-06 will set the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ctfmon
ctfmon.exe

HKLM\Software\Microsoft
engine
'

Troj/SDBot-06 may also attempt to download the files la.exe and list.doc from a remote website.