Trojan-Downloader.Win32.Small.fxl

Technical Details

This malicious program is a Trojan. It is a Windows PE EXE file. It is 12788 bytes in size.

Installation

When installing, the Trojan copies its executable file to the Windows system directory:

In order to ensure that it is launched each time the system is started, the Trojan creates a service called "Microsoft security update service".

Payload

When launching, the Trojan injects its code into svchost.exe, a system process.

It then registers on the remote malicious user's site by opening the following URL.

The header of the request to the server contains the version of Windows running on the victim machine.

The server responds to the request by sending commands which determine what the Trojan will then do. The commands are as follows:

1. flood – flooding a designated server with a large number of packets. The types of attack are listed below:
   1. ICMP
   3. SYN
   5. HTTP
   6. UDP
2. stop – this will immediately stop the packets being sent.
3. die – deletes the Trojan file and the service it created.
4. open – opens a specific link using Internet Explorer.
5. get - downloads a file from a specified link and launches it for execution. Downloaded files are saved to %Temp% under a temporary name.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process.
2. Delete the following service:
   "Microsoft security update service"
3. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
4. Delete the following file:
   %System%\mssrv32.exe
5. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).