Backdoor.SDBot Description

Backdoor.SDBot is a Trojan virus. Once installed on the computer, Backdoor.SDBot will allow remote attackers to control the compromised machine through the IRC network. Backdoor.SDBot also includes a self-updating feature and opens a large security vulnerability on the system. Backdoor.SDBot is a serious threat to personal and financial information.

Type: Backdoors

How Can You Detect Backdoor.SDBot?

Backdoor.SDBot Technical Report

As new Backdoor.SDBot details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following Backdoor.SDBot files with its MD5s were created in the system:

Backdoor.SDBot has typically the following processes in memory:

• Explorer .exe
• mslsrv.exe
• wupdmgr.dll
• winsystem.exe
• scost.exe
• lpdriver.sys

Backdoor.SDBot creates the following registry entries:

• SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\wincfg
• Software\Microsoft\Windows\CurrentVersion\RunOnce\wincfg
• SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\Microsoft Update
• SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\Windows Explorer

Important Article Disclaimer