Trojan-Downloader.JS.Small.dz

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads other malicious programs from the Internet and launches them on the victim machine. It is a HTML page which contains a JavaScript scenario (HTML file). It is 5461 bytes in size. It is written in Java Script.

Payload

Once launched, the Trojan attempts to download files from the following link:

http://life.c-commando.info/***

These files will be saved to the C: root directory.

C:\nsl.exe
C:\U.exe 

The files are then launched for execution.

(At the moment of writing, this link was not working.)

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
2. Use Task Manager to terminate the processes listed below:

   nsl.exe
   U.exe

3. Delete the following files:

   C:\nsl.exe
   C:\U.exe

4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).