Trojan-Downloader.Win32.VB.ait

Technical Details

This Trojan downloads files from the Internet without the user's knowledge. It is a Windows application (PE EXE file). It is 20 480 bytes in size. It is written in Visual Basic.

MD5: e63b46c020d038b49f568b1e32e0dfb1

SHA1: 570c4f75592cfd3c405647445a8ee8cfe29f1217

Payload

When launched, the Trojan downloads files from the Internet via the following links:

http://8661***.*322.org/881.exe
http://8661***.*322.org/882.exe
http://8661***.*322.org/883.exe
http://8661***.*322.org/884.exe
http://8661***.*322.org/885.exe

At the time of writing, these links were inactive.

The downloaded files are saved under the following names, respectively:

C:\Program Files\881.exe
C:\Program Files\882.exe
C:\Program Files\883.exe
C:\Program Files\884.exe
C:\Program Files\885.exe

The Trojan then launches the downloaded files for execution and ceases running.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the following files:

   C:\Program Files\881.exe
   C:\Program Files\882.exe
   C:\Program Files\883.exe
   C:\Program Files\884.exe
   C:\Program Files\885.exe
   

2. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).