Backdoor:W32/Small.H

Classification

Category:

Malware

Platform:

W32

Type:

Backdoor

Aliases:

Backdoor:W32/Small.H
Virus.Win32.Small.h

Summary

A remote administration tool (RAT) that bypasses the security features of a program, computer or network to give unauthorized access or control to its user.

Removal

Technical Details

Small.H is a virus with an internal spamming engine and backdoor functionality. Please see the sections below for more details.Small.H, originally named lsass.exe, spreads itself using an internal spaming-engine that is controlled through a previously set-up backdoor.It fools the user into executing its exe file by using a Windows folder icon and file names such as:

Data.exe
Documents.exe
HotPictures.exe
HotXXX.exe
ImageGirls.exe
SexyBoy.exe
SexyGirls.exe
Songs.exe

Small.H creates several copies of itself:

C:\[Documents and Settings]\[Current User]\csrss.exe
C:\[Documents and Settings]\[Current User]\Local Settings\Temp\FolderData.exe
C:\[Documents and Settings]\[Current User]\winlogon.exe
C:\RECYCLER\lsass.exe
C:\RECYCLER\msinfo\msinfo.exe

It creates a number of autostart keys in the registry such as:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Added value to "System" Added value to "Userinit"
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] Added value to "load"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] Added value to (Default)
Service key tree: o [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsInfo]