Threat Description

Small.CGS

Details

Aliases:Small.CGS
Category:Malware
Type:Trojan
Platform:W32

Summary



We got reports of this trojan downloader on Jan 27th 2006. The trojan downloader was spammed to a large amount of e-mail addresses. The downloader is programmed to download a backdoor from website.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.



Technical Details



The trojan's file is a PE executable file packed with FSG file compressor. According to reports, the trojan was spammed in messages that looked like this:

Subject: YOUR BILL PAYMENT NOT APPROVED!Attachment: BILL_235563880.EXE

When the attachment is run, the trojan first tries to add its file to Windows XP built-in firewall policy using the following key:

[HKLM\PATH_TO_FW_POLICY\AuthorizedApplications\List]

After that, the trojan tries to download and activate backdoor from web site dalvabrothersinc.com . The backdoor is already detected as Trojan.Win32.Delf.qx with FSAV updates version 2005-12-23_1.



Detection


Small.CGS is detected with the following F-Secure Anti-Virus updates:
Detection Type: PC
Database: 2006-01-27_01



Description Created: Jarkko Turkulainen, January 27, 2006
Technical Details: Jarkko Turkulainen, January 27, 2006


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Learn More

Disinfect your PC

F-Secure Anti-Virus will disinfect your PC and remove all harmful files

Learn More