Virus: TR/Dldr.Small.bws Date discovered: 10/01/2006 Type: Trojan Subtype: Downloader In the wild: No Reported Infections: Low Distribution Potential: Low Damage Potential: Low to medium Static file: Yes File size: 3.829 Bytes MD5 checksum: 3bfdf9916546db9a570302286d583af7
General Method of propagation: Aliases: Platforms / OS: Side effects: Files %WINDIR% \kl.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: TR/Spy.Small.DG.8 %WINDIR% \tool2.exe Furthermore this file gets executed after it was fully downloaded. Detected as: TR/Killav.DB.2 %WINDIR% \toolbar.exe Furthermore this file gets executed after it was fully downloaded. Detected as: TR/Dldr.Adload.J.14 %WINDIR% \tool2.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: TR/Killav.DB.2 %WINDIR% \tool3.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: TR/Killav.DB.2 %WINDIR% \tool4.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: TR/Killav.DB.2 %WINDIR% \tool5.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: TR/Killav.DB.2 %WINDIR% \secure32.html Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: TR/Dldr.Sma.bfy.5.B %SYSDIR% \paytime.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: TR/StartPage.adi.5 %WINDIR% \ms1.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: TR/Dldr.Smal.xk.3.A %WINDIR% \hosts Furthermore this file gets executed after it was fully downloaded. At the time of writing this file was not online for further investigation. %random character string% &code2=%several random digits% %WINDIR% \uniq Furthermore this file gets executed after it was fully downloaded. At the time of writing this file was not online for further investigation. Registry File details Programming language: The malware program was written in MS Visual C++. Runtime packer:
Description inserted by Iulia Diaconescu on Tuesday, January 10, 2006
Back
.
.
.
.
