Troj/Sdbot-XM

Please follow the instructions for removing Trojans.

Change any data that may have become compromised.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

and remove any reference to any file you deleted.

Close the registry editor.

Troj/Sdbot-XM is a Windows Trojan that contains backdoor functions that allows unauthorised remote access to the infected computer via IRC channels.

When run Troj/Sdbot-XM copies itself to the Windows system folder as a hidden, system file named amsngr.exe.

The Trojan also creates the following registry entries so that it is able to run on user logon or computer restart:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Clock_Manager
%SYSTEM%\amsngr.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Clock_Manager
%SYSTEM%\amsngr.exe

Troj/Sdbot-XM will attempt to steal CD keys, partake in distributed denial-of-service (DDoS) attacks, download and run files from the internet and log keystrokes when instructed to do so by a remote attacker.