TrojanDropper:Win32/Surldoe.gen!A

Detected by Microsoft Defender Antivirus

Aliases: Win32/AMalum.BYPO (CA) Backdoor.Win32.SdBot.fgl (Kaspersky) W32/Sdbot.worm (McAfee)

Summary

TrojanDropper:Win32/Surldoe.gen!A is a trojan that masquerades as an installer of legitimate software, but also installs malware on a targeted system. It drops and runs two or more files, one of which is usually a clean installer file, whilst the others are malware. It is commonly used to install variants of the Win32/Rbot family, but variants of other malware families have also been observed being installed, including Win32/Vundo, Win32/Matcash, and Win32/Brancud.

Manual removal is not recommended for this threat. Use Microsoft Security Essentials or another up-to-date scanning and removal tool to detect and remove this threat and other unwanted software from your computer. For more information on Microsoft security products, see http://www.microsoft.com/protect/products/computer/default.mspx.

Installer Filename	Clean Filename	Clean Software	Malware Filename(s)	Malware Family
launcher.exe	launcher.exe	Indigo Rose Autorun MAX!	vdm0.99.exe	Backdoor:Win32/Rbot
minilyrics6.exe	minilyrics6.exe	Crintsoft Minilyrics	vdm0.88.exe	Backdoor:Win32/Rbot
Larry.exe	Larry.exe	Leisure Suit Larry game	rtg.17.exe	Backdoor:Win32/Rbot
setuponecare.exe	setuponecare.exe	Windows Live OneCare Installer	adx.exe is153679-5-8.exe wave-5-13.exe	Trojan:Win32/Vundo TrojanDownloader:Win32/Matcash
66 kis keys.exe	66 kis keys.exe	Keygen	ar_install.exe inst_ctfmon.exe server-loggermyself.exe	MonitoringTool:Win32/Ardamax MonitoringTool:Win32/PerfectKeylogger
WindowsInstaller-KB893803-v2-x86.exe	WindowsInstaller-KB893803-v2-x86.exe	Windows Patch	blat.exe	Trojan:Win32/Brancud

TrojanDropper:Win32/Surldoe.gen!A

Summary

What to do now

Technical information

Threat behavior

Payload

Prevention

Symptoms