Trojan-Downloader.Win32.Small.tne

Technical Details

This Trojan downloads other programs to the victim machine via the Internet and launches them for execution without the user's knowledge or consent. It is a Windows PE EXE file. It is 1913 bytes in size. It is packed using FSG. The unpacked file is approximately 14KB in size. It is written in C++.

Payload

Once launched, the Trojan launches a system process called "svchost.exe" and injects its code into the address space of this process. The Trojan code downloads four files from the following links:

Malicious programs from the families listed below may be downloaded from these links:

Downloaded files will be saved to the Trojan's working directory under the following names:

The Trojan then launches the files for execution, creates a batch file in its working directory, launches this file for execution and then ceases running. This file deletes the original Trojan file, the downloaded file and also deletes itself.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).