Trojan-Downloader.Win32.Small.dnk

Technical Details

This Trojan downloads files via the Internet without the user’s knowledge or consent. It is a Windows PE EXE file. It is 7488 bytes in size. It is packed using UPX. The unpacked file is approximately 30KB in size.

Payload

The Trojan injects its code into the svchost.exe process, which will then download files from the links shown below:

These files will be saved as follows:

The files are then launched for execution.

At the moment of writing, none of the links shown above were not working.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the malicious program’s process.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following files:
   %Temp%\vxga4me1.exe
   %Temp%\vxga3me2.exe
   %Temp%\vxga5me3.exe
   %Temp%\vxg6ame4.exe
   %Temp%\vxga7me5.exe
   %Temp%\vxga8me6.exe
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).