Trojan-Downloader.Win32.Small.bai

Technical Details

This Trojan downloads other files via the Internet and launches them for execution on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 6648 bytes in size.

Installation

When launched, the Trojan will copy its executable file as:

Payload

The Trojan downloads files from the following URLs:

At the time of writing, these links were not working.

The downloaded files are downloaded to the current user's Windows temporary file under a random name which is made up of numbers. The files are then launched for execution.

The Trojan will then simulate answering 'Yes' to the Kaspersky Internet Security warning about network activity caused by the Trojan's executable file.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following file:
   %TEMP%\ssvchst.exe
4. Delete the contents of %Temp%.
5. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).