Trojan-Downloader.MSIL.Small.cn

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads other malicious programs from the Internet and launches them for execution without the user's knowledge. It is a Windows .Net application (PE EXE file). It is 11 499 bytes in size. It is written in Visual Basic .Net.

Payload

Once launched, the Trojan downloads a file from the following link:

http://h***way.com/korabika/pic.exe

At the time of writing, this link was inactive.

The downloaded file is saved under the name:

C:\Documents and Settings\Administrateur\Start Menu\Programs\startup\aminox

The Trojan then launches this file for execution and ceases running.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the following file:

   C:\Documents and Settings\Administrateur\Start Menu\Programs\startup\aminox

2. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).