Trojan-Downloader.Win32.VB.bj

Once launched, the Trojan downloads files from the following URL:

http://w1.***.telia.com/~u46129234/xpnv.exe

At the moment of writing, this link was not working.

The downloaded file will be saved as:

%WinDir%\xpnv.exe

The Trojan then launches this file for execution.

1. Use Task Manager to terminate the Trojan process:
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following file:

   %WinDir%\xpnv.exe

4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus)

This Trojan downloads software via the Internet without the knowledge or consent of the user. The program itself is a Windows PE EXE file. The file is 24,576 bytes in size. It is written in Visual Basic.