Trojan-Downloader.Win32.Small.cck

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads other programs via the Internet and launches them on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 3,584 bytes in size.

Payload

Once launched, the Trojan downloads a file from the following URL:

www.**desk-soft.com/hdesk_offer_**/SPSetup.exe

(At the time of writing, this link was not working.)

The Trojan then saves the file it downloaded to the Windows temporary directory:

%Temp%\SPSetup.exe

The file will then be launched for execution.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following file:

   %Temp%\SPSetup.exe

4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).