Backdoor.sdbot trojan

Have any of you folks on this list seen a re-occurrance of the "Backdoor.sdbot" trojan? I am responsible for several groups of student use computers here and this morning while doing a normal walk-thru I noticed that over half of my machines had several copies of this in quarantine.

According to Symantec, this program comes down through IRC clients and will open a backdoor on the infected machine through port 6667. It was first protected by Symantec/Norton on May 1, 2002 but this is the first I have seen or heard of it.

We are using Win2k PRo with Symantec/Norton CE 7.6 that is set to update daily. The student users have restricted user rights on the computers so they cannot install these programs(IRC) and when I set up the computers every year I remove any programs like this(IRC).

I was just curious if this is a new attack started possibly overnight or just a fluke thing here.

Thanks to all.

Rich Received on Fri Nov 8 21:03:14 2002