Threat Description

Backdoor: W32/SdBot.CKF


Category: Malware
Type: Backdoor
Platform: W32
Aliases: Backdoor:W32/SdBot.CKF, Backdoor.Win32.SdBot.ebp


Backdoor:W32/SdBot.CKF is a backdoor. Backdoors are remote administration utilities that open infected machines to external control via the Internet or a local network. Upon execution, SdBot.CKF will attempt to connect to an IRC server and tries to download additional malware to the infected machine.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

Upon execution, SdBot.CKF will create a copy of itself in the following location:

  • %windir%\winudspm.exe

It creates the following registry entry to automatically start with Windows:

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows UDP Control = winudspm.exe

Once the backdoor is active, it connects to an IRC server, joins a certain channel and acts as a bot. The backdoor will try to contact the following IRC server:


Then it joins the following channels:

  • #blockbot2
  • #blockbot.msn

The malware attempts to download from the following locations:


The files are detected as follows:

  • dci.exe - Backdoor:W32/Rbot.GLP
  • is154890 - Trojan-Downloader.Win32.Agent.rcl
  • setup.exe - Backdoor:W32/IRCBot.GNS

Here are more commands used by the bot:

  • aim.stop
  • download
  • gone
  • l
  • lo
  • login
  • logout
  • msn.stop
  • r.getfile
  • r.upd4te
  • r.update
  • rm
  • rmzerm3b1tch
  • triton.stop
  • update

Furthermore, another sign of infection from this malware is an outbound connection to


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More