Small.QP copies itself to the Windows folder and attempts to download and install other malware to the system.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
Upon execution, this malware creates the mutex _Win_Loader_ to ensure that only one instance of itself is running in memory.Additionally, it drops the following files in the affected system:
As a stealth mechanism, it loads the dropped DLL, winlogon32.dll, under the legitimate process: lsass.exe.Trojan-Downloader.Win32.Small.anj, on the other hand, creates the mutex _Win_Loader__Win_Loader_. This malware attempts to connect to the following web sites to possibly download other malicious components:
Small.QP then executes the downloaded file, _tmp0232.exe. Note: Both download sites are unavailable at the time of writing.There are additional details on Small.QP on F-Secure's Weblog.
Date Created: -
Date Last Modified: -