The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1


Detected Nov 12 2002 20:00 GMT
Released Nov 13 2002 20:00 GMT
Published Oct 25 2007 16:37 GMT

Technical Details
Removal instructions

Technical Details

This Trojan has a malicious payload. This Trojan is a Windows PE EXE file. It is 35328 bytes in size.


The Trojan runs the following commands within its working folder:

echo del *.txt
echo del *.doc
echo del *.xls
echo del *.com
echo del *.dll
echo del *.dot
echo del *.bin
echo del *.htm
echo del *.ppt
echo del *.avi
echo del *.mp3
echo del *.src
echo del *.bmp
echo del *.cfg
echo del *.mpg
echo del *.drv
echo del *.vxd
echo del *.mdb

This will lead to all files with the extensions shown above being deleted from the Trojan’s working folder.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

  1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
  2. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).

Bookmark and Share

This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.

This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.

Other versions