Trojan.Win32.Small.dl

Technical Details

This Trojan has a malicious payload. It is a Windows PE EXE file. It is 24 576 bytes in size. It is written in C++.

Installation

When launched, the Trojan copies its executable file to the Windows system directory under the original file name.

In order to ensure that the Trojan is launched automatically each time the system is booted, it registers its executable file in the system registry:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"wins" = "%System%\<original name of Trojan file> "

Payload

Every 55 minutes, the Trojan uses Internet Explorer to open one of the following links:

http://bbsdown.cn/aabb.html
http://552779.cn/aabb.html

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the copy of the Trojan from the Windows system directory
4. Delete the following system registry key: (see What is a system registry and how do I use it for details on how to edit the registry).

   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   "wins" = "%System%\<original name of Trojan file> "

5. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).