Troj/Sdbot-Z

Please follow the instructions for removing Trojans.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\
Run\ svchosts="svchosts.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\
RunServices\ svchosts="svchosts.exe"

and delete them if they exist.

Close the registry editor.

Troj/Sdbot-Z is a backdoor Trojan which allows a remote intruder to access and control the computer via IRC channels.

Troj/Sdbot-Z joins a specific channel on an IRC server and then runs continuously in the background as a service process, listening on the IRC channel for specific commands and carrying out the appropriate actions.

When first run the Troj/Sdbot-Z drops a copy of itself to the Windows system folder with the filename svchosts.exe and creates the following registry entries so that this file is run on Windows startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\
Run\ svchosts="svchosts.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\
RunServices\ svchosts="svchosts.exe"