Trojan-Downloader.Win32.Small.asa

Technical Details

This Trojan program downloads files from the Internet without the user's knowledge or consent. The Trojan itself is a Windows PE EXE file 4745 bytes in size, written in C++ and packed using FSG. The unpacked file is approximately 57KB in size.

Installation

When launching, the Trojan copies itself to the Windows system directory as priva.exe:

It then registers this file in the system registry, ensuring that the Trojan will be launched each time Windows is rebooted on the victim machine:

Payload

Every hour the Trojan launches the following process in an invisible window:

The Trojan is able to download other files from the Internet and launch them on the victim machine.

Removal instructions

1. Delete the original Trojan file. (Its location will depend on how the victim machine was infected.)
2. Use Task Manager to terminate the Trojan process:
   priva.exe
3. Delete the copy of the Trojan:
   %System%\priva.exe
4. Update your antivirus databases and perform a full scan of the computer (download trial version).