Trojan-Downloader.Win32.Genome.cfbv

Technical Details

This Trojan installs and launches other programs on the infected computer without the user's knowledge. It is a Windows application (PE EXE file). It is 5120 bytes in size. It is written in C++.

Payload

This Trojan program is injected into the address space of the process "explorer.exe" using a malicious program which is detected by Kaspersky Anti-Virus as Trojan-Downloader.Win32.Small.laa.

When launched, the Trojan downloads two files from the Internet at the following links:

http://c0.sh***ker.net/mn/d.php
http://c0.sh***ker.net/mn/c.php

At the time of writing, these links were inactive.

The downloaded files are saved to the Temporary Internet Files folder under random names.

The Trojan then launches these files for execution and ceases running.

Removal instructions

If your computer does not have antivirus protection and has been infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Empty the Temporary Internet Files folder, which may contain infected files (How to delete infected files from Temporary Internet Files folder?)
3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).