Skip to main content

Backdoor:W32/SdBot.CKF

Classification

Category:Malware
Type:Backdoor
Platform:W32
Aliases:

Backdoor:W32/SdBot.CKF, Backdoor.Win32.SdBot.ebp

Summary

Backdoor:W32/SdBot.CKF is a backdoor. Backdoors are remote administration utilities that open infected machines to external control via the Internet or a local network. Upon execution, SdBot.CKF will attempt to connect to an IRC server and tries to download additional malware to the infected machine.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

Upon execution, SdBot.CKF will create a copy of itself in the following location:

  • %windir%\winudspm.exe

It creates the following registry entry to automatically start with Windows:

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows UDP Control = winudspm.exe

Once the backdoor is active, it connects to an IRC server, joins a certain channel and acts as a bot. The backdoor will try to contact the following IRC server:

  • irc.bluehell.org
  • 221.6.6.232

Then it joins the following channels:

  • #blockbot2
  • #blockbot.msn

The malware attempts to download from the following locations:

  • http://mitglied.lycos.de/cheatsguard/dci.exe
  • http://mitglied.lycos.de/cheatsguard/is154890.exe
  • http://mitglied.lycos.de/subzz/setup.exe

The files are detected as follows:

  • dci.exe - Backdoor:W32/Rbot.GLP
  • is154890 - Trojan-Downloader.Win32.Agent.rcl
  • setup.exe - Backdoor:W32/IRCBot.GNS

Here are more commands used by the bot:

  • aim.stop
  • download
  • gone
  • l
  • lo
  • login
  • logout
  • msn.stop
  • r.getfile
  • r.new
  • r.upd4te
  • r.update
  • rm
  • rmzerm3b1tch
  • triton.stop
  • update

Furthermore, another sign of infection from this malware is an outbound connection to http.xn--mg-kka.com.

More Support

Community

Ask questions in our Community.

User guides

Check the user guide for instructions.

Contact Support

Chat with with or call an agent.

Submit a Sample

Submit a file or URL for analysis.