Troj/Sdbot-MM

Please follow the instructions for removing Trojans.

You will also need to edit the following registry entries, if present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Spooler Subsytem App
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Spooler Subsytem App

and remove any reference to any file you deleted.

Close the registry editor.

In order to run automatically when Windows starts up the Trojan copies itself to the Windows system folder and adds the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Spooler Subsytem App
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Spooler Subsytem App

Once installed Troj/Sdbot-MM connects to a preconfigured IRC server in order to wait for further instructions. These instructions can cause the Trojan to:

• list/kill processes and threads
• retrieve details about the OS version and infected system
• upload and download files
• send messages to IM networks
• execute arbitrary commands
• download and install updated versions of itself
• steal CD and software keys
• flood another machine
• run a socks4 proxy server
• redirect TCP ports
• perform DNS lookups
• retrieve the contents of the clipboard