Skydance (2.16 Beta)
     Server name: Skydance
     Version: 2.16 Beta
     Different versions: None
     Tested: Yes, on Windows 95 and Windows NT
     Server size: 160K
     Server files: Skd.exe
     Server icon:
     [Image]
     Infects: Windows 95, 98.
     Autoloads: Registry:
     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
     Key: Skd
     Default port: 4000 TCP
     Can port be changed: Yes

     Server Features

        * File manager
        * Send message box
        * Restart or shutdown windows
        * Swap mouse button
        * Send message saying System Settings Change,
          you must restart windows.
        * Shutdown SKD
        * View, close or close all running windows


   Comments
   Skydance 2.16 beta is a normal trojan. The home
   page for this trojan contains Visual Basic
   Scripts (.vbs like the ILOVEYOU virus) that can
   send outlook emails, disable/enable IE security,
   set the start page for IE and export Windows Reg
   key to regkey.txt.

   How To Remove
   Quick fix: no quick fix programs
   Manual removal:

     1. Remove the Skd key in the registry located
        at
        HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
        Which can be done with regedit or any other
        registry editing program.
     2. Reboot the computer or close Skd.exe.
     3. Delete the trojan file Skd.exe in the
        windows directory.