Home > Threat descriptions >

Trojan-Downloader:W32/Small.EKV

Classification

Category: Malware

Type: Trojan-Downloader

Aliases: Trojan-Downloader:W32/Small.EKV

Summary


This type of trojan secretly downloads malicious files from a remote server, then installs and executes the files.

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


Trojan-Downloader:W32/Small.EKV attempts to download and install other malware to the system. Small.EKV arrives on the system as a downloaded file of Exploit:W32/Ani.C.

Execution

Upon execution, it launches Internet Explorer by using the following hard-coded path:

  • C:\program files\Internet Explorer\Iexplore.exe

It then injects the code to Internet Explorer and proceeds to download and execute another file from the following site:

  • http://220.71.76.189/[REMOVED].exe

The site listed above is currently inaccessible as of the time of this writing.

Detection

F-Secure Anti-Virus detects this malware with the following updates:

Detection Type: PC

Database: 2007-03-29_10