Internet threat level: 1
Home→Descriptions→Trojan-Downloader.Win32.Small.tos
Trojan-Downloader.Win32.Small.tos
| Detected | Mar 27 2008 17:08 GMT |
| Released | Mar 27 2008 21:00 GMT |
| Published | Apr 25 2008 15:15 GMT |
Payload
Removal instructions
Technical Details
This Trojan downloads other programs to the victim machine via the Internet and launches them for execution without the user's knowledge or consent. It is a Windows PE EXE file. It is 1889 bytes in size. It is packed using FSG. The unpacked file is approximately 14KB in size. It is written in C++.
Payload
Once launched, the Trojan launches a system process called "svchost.exe" and injects its code into the address space of this process. The Trojan code downloads two files from the following links:
Malicious programs from the families listed below may be downloaded from these links:
Trojan-Downloader.Win32.Agent
Trojan-Downloader.Win32.Bagle
Trojan-Downloader.Win32.Zanoza
Trojan-Proxy.Win32.Daemonize
Trojan-Proxy.Win32.Mitglieder
Trojan-Spy.Win32.Iespy
Downloaded files will be saved to the Trojan's working directory under the following names:
The Trojan then launches the files for execution, creates a batch file in its working directory, launches this file for execution and then ceases running. This file deletes the original Trojan file, the downloaded file and also deletes itself.
Removal instructions
If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:
- Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.
Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).
This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.
Trojan-Downloader.
- Trojan:
PWS-Banker. bn (McAfee) - Mal/Packer (Sophos)
- Trojan.
OnlineGames-1517 (ClamAV) - Trj/Downloader.
QXD (Panda) - W32/Downloader.
AO. gen!Eldorado (FPROT) - TrojanDownloader:
Win32/Agent. WX (MS(OneCare)) - Trojan.
DownLoader. 36816 (DrWeb) - Win32/TrojanDownloader.
Small. DRU (Nod32) - Trojan.
Downloader. Agent. ZFJ (BitDef7) - Win32:
Tiny-TH [Trj] (AVAST) - Downloader (NAV)
- PWS-Banker.
bn (NAI)
