Trojan-Clicker.Win32.Small.h

Technical Details

This primitive Win32 Trojan is designed to falsify the number of hits on www.sex.de. It is written in Assembler and is 3072 bytes in size. It is not packed in any way.

Payload

Once launched, the Trojan creates the following record in the system registry:

The Trojan then waits for the victim machine to connect to the Internet. When it detects a connection, it launches 4 streams, and then lapses into an unending cycle. 2 of the streams connect to the sex.de server and 2 to the www.sex.de server. The connection is via port 80.

The Trojan may noticeably slow the victim machine and generate a significant amount of traffic.

Removal instructions

1. Use Task Manager to terminate the Trojan process (the process will have the same name as the Trojan file)
2. Delete the original Trojan file (its location will depend on how the Trojan initially penetrated the victim machine).
3. Delete the following registry key:
   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
    "MsSystem"="c:\msdos.exe"
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).