Trojan-Downloader.Win32.Small.yt

Technical Details

This Trojan program downloads files from the Internet without the knowledge or consent of the user. The Trojan itself is a Windows PE EXE file, 5120 bytes in size, packed using UPX. The unpacked file is 10240 bytes in size.

Payload

Once launched, the Trojan creates the following files on the victim computer:

%Windir%\mstasks1.exe
%Windir%\mstasks2.exe
%Windir%\mstasks3.exe
%System%\dktibs.exe
%System%\systime.exe
%Windir%\test
%Windir%\toolbar.exe

This files are zero sized.

The Trojan then downloads updates to the files which has created on the victim computer via the Internet, without the knowledge or consent of the user. The files will then be launched for execution.

The Trojan also modifies the %System%\drivers\etc\hosts file by adding the following text. This means the user is unable to access the sites listed from the victim machine.

127.0.0.3 n-glx.s-redirect.com
127.0.0.3 x.full-tgp.net
127.0.0.3 counter.sexmaniack.com
127.0.0.3 autoescrowpay.com
127.0.0.3 www.autoescrowpay.com
127.0.0.3 www.awmdabest.com
127.0.0.3 www.sexfiles.nu
127.0.0.3 awmdabest.com
127.0.0.3 sexfiles.nu
127.0.0.3 allforadult.com
127.0.0.3 www.allforadult.com
127.0.0.3 www.iframe.biz
127.0.0.3 iframe.biz
127.0.0.3 www.newiframe.biz
127.0.0.3 newiframe.biz
127.0.0.3 www.vesbiz.biz
127.0.0.3 vesbiz.biz
127.0.0.3 www.pizdato.biz
127.0.0.3 pizdato.biz
127.0.0.3 www.aaasexypics.com
127.0.0.3 aaasexypics.com
127.0.0.3 www.virgin-tgp.net
127.0.0.3 virgin-tgp.net

Removal instructions

1. Delete the original Trojan file (the location depends on how the Trojan actually penetrated the victim machine).
2. Delete all files installed by the Trojan (listed below):

   %Windir%\mstasks1.exe
   %Windir%\mstasks2.exe
   %Windir%\mstasks3.exe
   %System%\dktibs.exe
   %System%\systime.exe
   %Windir%\test
   %Windir%\toolbar.exe

3. Open the %System%\drivers\etc\hosts file using any text editing program (e.g. Notepad) and manually delete all strings created in the file. Save changes and close the file.
4. Update your antivirus databases, and perform a full scan of your computer (download a trial version of Kaspersky Anti-Virus).