Downloader.small trojan .... need help

[TX2]

I am trying to clean a Win98 system infected with the Trojan
"Downloader.small"

I can't seem to find out much information about how to clean this virus.

The system in question has NAV 2001 installed
(which was, we thought, fully up-to-date)

On Windows start-up, there is an error message concerning a 'memory'
issue with 'loads' of numbers.

NAV will not load as expected, and clicking the shortcut off the start
menu results in the memory error message being displayed.

We tried to install AVG 6, but although AVG finds the virus during the
DOS part of the boot process, we get a similar memory error message when
Windows loads.

AVG reports the infected file as C:\DLOAD.EXE

Both AV's seem unable to clean the virus, with NAV failing to run at
all.

We 'borrowed' a copy of Norton Internet Security 2003, and tried to
install that, but again, it won't load at Windows startup, and now we
have hit a different snag because on trying to uninstall it, Windows
reports that it's running!

We are also unable to run msconfig or regedit, again, the result being a
memory error message.

Help!

 

[null]

I am trying to clean a Win98 system infected with the Trojan
"Downloader.small"

I can't seem to find out much information about how to clean this virus.

The system in question has NAV 2001 installed
(which was, we thought, fully up-to-date)

On Windows start-up, there is an error message concerning a 'memory'
issue with 'loads' of numbers.

NAV will not load as expected, and clicking the shortcut off the start
menu results in the memory error message being displayed.

We tried to install AVG 6, but although AVG finds the virus during the
DOS part of the boot process, we get a similar memory error message when
Windows loads.

AVG reports the infected file as C:\DLOAD.EXE

Both AV's seem unable to clean the virus, with NAV failing to run at
all.

We 'borrowed' a copy of Norton Internet Security 2003, and tried to
install that, but again, it won't load at Windows startup, and now we
have hit a different snag because on trying to uninstall it, Windows
reports that it's running!

We are also unable to run msconfig or regedit, again, the result being a
memory error message.

Help!

Project VGREP is useful for tracking down info. Here's a result for a
search on downloader.small:

http://www.virusbtn.com/resources/vgrep/vgrep.cgi?terms=downloader.small&product=0

You'll find various alternate malware names and descriptions. Then see
if the file names mentioned in the writeups exist on the affected PC.

Also, there are several alternate av scanners you can try (see my web
site) to see what malware names they come up with. And I have links to
generic methods as well such as KAV's Trojan_Finder which will show
running processes, registry entries and various startup axis files. If
you need help with the latter, post the log file here.

Finally, use a software firewall to identify a port number and app
used by the malware.


Art
http://www.epix.net/~artnpeg

 

[TX2]

Project VGREP is useful for tracking down info. Here's a result for a
search on downloader.small

The actual variant is downloader.small.ad
It has infected the DLOAD.EXE file on C:\

Sorry to act dumb, but i can't figure out what i'm to do on that site
you posted ....

:-/

 

[null]

The actual variant is downloader.small.ad
It has infected the DLOAD.EXE file on C:\

Sorry to act dumb, but i can't figure out what i'm to do on that site
you posted ....

Well, there is no result when you search downloader.small.ad so it's
likely a new variant. When you click on a vendor's name you are
sometimes led to a description. That's why I sent you there.

So follow up on my other suggestions. Post the log file here produced
by KAV's Trojan_Finder. The downloader Trojans install other Trojans
so there may be several that must be removed.

And try Trend's Sysclean to see what it finds and what it can clean.


Art
http://www.epix.net/~artnpeg

 

[TX2]

Well, there is no result when you search downloader.small.ad so it's
likely a new variant.

gah ... not good.

So follow up on my other suggestions. Post the log file here produced
by KAV's Trojan_Finder. The downloader Trojans install other Trojans
so there may be several that must be removed.

OK, but i'm not due back there (to where the PC is) 'till Saturday
The owner has already hinted at a format and reinstall for a variety of
other reasons, so i may not get chance to deal with it.

And try Trend's Sysclean to see what it finds and what it can clean.

Will do. tnx for the help thus far.

 

[Gabriele Neukam]

On that special day, TX2, ([email protected])
said...

It has infected the DLOAD.EXE file on C:\

Dload.exe isn't infected, it IS the trojan. The name speaks for itself:
DownLOADer.EXEcutable.


Gabriele Neukam

(e-mail address removed)