Virus:Trojan.Win32.Small.eu

Other versions: .c , .ev , .nt

Aliases

Trojan.Win32.Small.eu ( Kaspersky Lab ) is also known as: Trojan.Fakealert ( Doctor Web ), TR/Small.EU ( H+BEDV ), Trojan.Downloader.BCP ( SOFTWIN ), Trojan.Downloader.Small-453 ( ClamAV ), Trj/Downloader.BCP ( Panda )

Detection added	Jun 30 2005 03:28 GMT
Update released	Jun 30 2005 04:26 GMT
Description added	Jan 30 2006
Behavior	Trojan

Technical details

This Trojan is a Windows PE EXe file 3584 bytes in size.

Once launched, the Trojan registers this file in the system registry, ensuring that it will be launched each time Windows is rebooted on the victim machine:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Runonce] "MSSetup"="<path to Trojan file>"

The Trojan downloads a file named req.exe from http://us****tov.net/mysql/ and launches it for execution on the victim machine.

HOME