Summary
Small.QP copies itself to the Windows folder and attempts to download and install other malware to the system.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
- Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
- Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
- Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
Upon execution, this malware creates the mutex _Win_Loader_ to ensure that only one instance of itself is running in memory.Additionally, it drops the following files in the affected system:
- %windir%\winlogon32.exe - A copy of itself (Detected as Trojan-Dropper.Win32.Small.qp)
- %windir%\winlogon32.dll - Another malware file (Detected as Trojan-Downloader.Win32.Small.anj)
- %windir%\prefoct.dat - An empty file
As a stealth mechanism, it loads the dropped DLL, winlogon32.dll, under the legitimate process: lsass.exe.Trojan-Downloader.Win32.Small.anj, on the other hand, creates the mutex _Win_Loader__Win_Loader_. This malware attempts to connect to the following web sites to possibly download other malicious components:
- https://www.max-stats.com/l/[REMOVED].php?i=21 Data downloaded is saved in the file, %windir%\prefoct.dat
- https://www.teen4-sex.com/[REMOVED].dat Data downloaded is saved in the file, %wndir%\_tmp0232.exe
Small.QP then executes the downloaded file, _tmp0232.exe. Note: Both download sites are unavailable at the time of writing.There are additional details on Small.QP on F-Secure's Weblog.
More Support
Community
Ask questions in our Community.
User guides
Check the user guide for instructions.
Contact Support
Chat with with or call an agent.
Submit a Sample
Submit a file or URL for analysis.