Trojan-Downloader.Win32.Small.aoa

Technical Details

This Trojan downloads files from the Internet without the user's knowledge or consent.

The Trojan itself is a Windows PE EXE file 5120 bytes in size, packed using UPX. The unpacked file is approximately 27KB in size.

Payload

Once launched, the Trojan creates the following entry in the system registry:

This particular Trojan does not create a file called srvc32.exe, which means that the Trojan will not be launched automatically when the oeprating system is started. However, such a file may be created by other Trojan programs.

The Trojan is able to download and launch other files on the victim machine. Files are downloaded from the following server:

These files are saved to the victim machine and then launched for execution:

C:\t.exe
C:\n.exe
C:\m.exe

Removal instructions

1. Delete the original Trojan file. (The location of this file will depend on how the victim machine was infected.)
2. Delete the files downloaded by the Trojan:

   C:\t.exe
   C:\n.exe
   C:\m.exe

3. Delete the following key from the system registry:
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Runonce]
   [HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "Local runole service"="%System%\srvc32.exe"
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).