Trojan-Downloader.Win32.Small.tot.tot

Once launched, the Trojan launches a system process called "svchost.exe" and injects its code into the address space of this process. The Trojan code downloads four files from the following links:

http://www.yvon-publicidad.com/images/images*****
http://www.yvon-publicidad.com/images/images*****
http://www.yvon-publicidad.com/images/images*****
http://www.yvon-publicidad.com/images/images*****

Malicious programs from the families listed below may be downloaded from these links:

Email-Worm.Win32.Bagle
Trojan-Downloader.Win32.Agent
Trojan-Downloader.Win32.Bagle
Trojan-Downloader.Win32.Zanoza
Trojan-Proxy.Win32.Daemonize
Trojan-Proxy.Win32.Mitglieder
Trojan-Spy.Win32.Iespy

Downloaded files will be saved to the Trojan's working directory under the following names:

%WorkDir%\chkdsk1.exe
%WorkDir%\chkdsk2.exe
%WorkDir%\chkdsk3.exe
%WorkDir%\ntupdate.exe

The Trojan then launches the files for execution, creates a batch file in its working directory, launches this file for execution and then ceases running. This file deletes the original Trojan file, the downloaded file and also deletes itself.

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).

This Trojan downloads other programs to the victim machine via the Internet and launches them for execution without the user's knowledge or consent. It is a Windows PE EXE file. It is 1929 bytes in size. It is packed using FSG. The unpacked file is approximately 14KB in size. It is written in C .

Payload