Trojan-Downloader.Win32.Small.laa

Detected	Mar 03 2011 02:59 GMT
Released	Mar 03 2011 08:51 GMT
Published	Apr 26 2011 11:32 GMT

Manual description Auto description

This description was created by experts at Kaspersky Lab. It contains the most accurate information available about this program.

Technical Details
Payload
Removal instructions

Technical Details

This program is a Trojan. It is a Windows application (PE EXE file). It is 11 017 bytes in size. It is written in C++.

MD5: 916aafb828c3dc048920befb6b0091ce

SHA1: 4644bece2b7fa3d33a3a81c9c34979839793c56d

Payload

When launching, the Trojan extracts the following file from its body and saves it to the Windows system directory under the name:

%System%\mn.dll

This file is 5120 bytes in size. It is detected by Kaspersky Anti-Virus as Trojan-Downloader.Win32.Genome.cfbv.

Then the Trojan injects the library created into the address space of the process "explorer.exe" and launches.

The Trojan then ceases running.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

Delete the following files:
```
%System%\mn.dll
```
Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).

Print

Share

Malicious programs

Trojans

Trojan-Downloader

Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.

Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).

This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.

Other versions

Trojan-Downloader.Win32.Small.abn

Trojan-Downloader.Win32.Small.aex

Trojan-Downloader.Win32.Small.anh

Trojan-Downloader.Win32.Small.aoa

Trojan-Downloader.Win32.Small.apc

Trojan-Downloader.Win32.Small.arf

Trojan-Downloader.Win32.Small.asa

Trojan-Downloader.Win32.Small.axk

Trojan-Downloader.Win32.Small.axp

Trojan-Downloader.Win32.Small.bab