trojan downloader: Trojan-Downloader.Win32.Small.b

Hazard level: Medium

virus Description

The sample is a downloader program ,its size is “38,400 bytes”, icon ““, Virus extension” exe “, mainly through the” Download Software Download “,” file bundle “,” Page Trojan “and other modes to spread, the main purpose of the virus is to download malware to the user’s computer to run.
After the user’s computer was infected, will appear Slow computer and network operations, processes and services, an unknown phenomenon.

Infection of the operating system
Windows 2000/Windows XP / Windows 2003/Windows Vista / Windows 7

Transmission

Document binding, pages Trojan, download software download

Manual Solution:

1, manually delete the following files:

% SystemRoot% \ system32 \ eeaea.exe

2, manually delete the following Registry:

HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ hoddos

Variable declaration:

% SystemDriver% partition where the operating system, typically “C: \”
% SystemRoot% WINDODWS directory, usually “C: \ Windows”
% Documents and Settings% user documentation directory, usually “C: \ Documents and Settings”
% Temp% temp folder, usually “C: \ Documents and Settings \ current user name \ Local Settings \ Temp”
% ProgramFiles% system program default installation directory, typically: “C: \ ProgramFiles”

The virus creates a file:

% SystemRoot% \ system32 \ eeaea.exe

Virus to create the registry:

HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ hzddos