W32/Sdbot-PI

Please follow the instructions for removing worms.

Check your administrator passwords and review network security.

Change any data that may have become compromised.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

and remove any reference to any file you deleted.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\

and remove any reference to any file you deleted.

Close the registry editor.

W32/Sdbot-PI is a network worm and backdoor for the Windows platform. The worm spreads to shared folders with weak passwords.

The backdoor component connects to a predefined IRC server and waits for commands from a remote attacker. W32/Sdbot-PI is a network worm and backdoor for the Windows platform. The worm spreads to shared folders with weak passwords.

The backdoor component connects to a predefined IRC server and waits for commands from a remote attacker.

When run W32/Sdbot-PI copies itself to the Windows system folder as ntlogin32.exe. The worm ensures that the copy is run each time Windows starts by adding the registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows NT Login = "ntlogin32.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Windows NT Login = "ntlogin32.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Windows NT Login = "ntlogin32.exe"

The backdoor component allows a remote attacker to:

transfer files to and from the infected computer
steal CD keys for certain game software
use the infected computer as a proxy server
launch distributed denial of service attacks