Aliases
Backdoor.IRCBot.gen
Type
Win32 worm
Description
W32/Sdbot-GK is a backdoor Trojan and network aware worm which runs in the background as a service process and allows unauthorised remote access to the computer via IRC channels.
W32/Sdbot-GK copies itself to the Windows system folder as mptcloaks.exe and creates the following registry entry so that the Trojan is run when a user logs on to Windows:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\MP Tcloaks
W32/Sdbot-GK remains resident, listening for commands from remote users. If the appropriate commands are received the Worm will begin scanning the internet for network shares with weak administrator passwords and will attempt to copy itself to these shares.
http://www.sophos.com/virusinfo/analyses/w32sdbotgk.html

Chowhound
Comic Vine
GameFAQs
GameSpot
Giant Bomb
TechRepublic