new user: File infected with trojan. please help

[Jacel]

I ran my freedom antivirus and found "W32/Sdbot.KH" trojan in C:\WINDOWS\system32\desktop.exe. I was told to delete the file. desktop is an application and im not so sure if it's wise to delete it.
Also, my PC won't restart or shutdown unless I use the main power button.

Thanks.

[nick s]

Try the removal tool here:

http://www.f-secure.com/v-descs/sdbot_md.shtml

Hopefully it will get rid of W32/Sdbot.KH.

Nick

[Arin]

that removal tool is for MD variant not KH. by the way SDBOT.KH is a backdoor so i suggest you delete that file immedietly. don't worry that file is not a windows native file so you can delete it. but if its resident then you won't be able to delete it. just remove it from registry from:

HKLM\software\microsoft\windows\currentversion\run

or

HKLM\software\microsoft\windows\currentversion\runservices