W32/Sdbot-PF

Please follow the instructions for removing worms.

Check your administrator passwords and review network security.

Change any data that may have become compromised.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Windows update config = svhost.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Windows update config = svhost.exe

and delete them if they exist.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\Windows update config = svhost.exe

and delete it if it exists.

Close the registry editor.

W32/Sdbot-PF copies itself to the Windows System (or System32 folder under MS Win NT/2000/XP) folder as svhost.exe and creates the following registry entries so that the Trojan is run when the computer restarts:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Windows update config = svhost.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Windows update config = svhost.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Windows update config = svhost.exe

W32/Sdbot-PF remains resident, listening for commands from remote users. If the appropriate commands are received the worm will begin scanning the internet for network shares with weak administrator passwords and will attempt to copy itself to these shares.

This worm can also initiate Synflood attacks, exploit computers infected with W32/MyDoom and attempt to steal CD keys from several computer games.

W32/Sdbot-PF can also delete shared drives and exploit the DCOM vulnerability on unpatched computers.