Trojan-Downloader.Win32.Small.fas

Technical Details

This Trojan downloads other malicious files via the Internet and launches them for execution on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 2964 bytes in size.

Payload

The Trojan launches a copy of svchost.exe, a system process, and injects its code into the process, which will in turn download files from the following link:

The file will then be saved to the Windows system directory:

At the moment of writing, the file placed on this link was 70656 bytes in size and detected by Kaspersky Anti-Virus as Trojan-Dropper.Win32.Agent.bot.

The downloaded file is then launched for execution.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following file:
   %System%\foto.exe
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).