Trojan-Downloader.Win32.Genome.abgp

Technical Details
Payload
Removal instructions

Technical Details

This Trojan downloads other malicious programs from the Internet and launches them for execution without the user's knowledge. It is a Windows application (PE EXE file). It is 5632 bytes in size. It is packed using UPX. The unpacked file is approximately 20 KB in size. It is written in Visual Basic.

Payload

The Trojan downloads a file from the following URL address:

http://www.free***town.com/image001/.scr

At the time of writing, this link was inactive.

The Trojan saves the downloaded file under the following name:

C:\WINDOWS\system32\.scr

The Trojan then launches the downloaded file for execution and ceases running.

Removal instructions

If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:

1. Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
2. Delete the following files:

   C:\WINDOWS\system32\.scr

3. Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).