TrojanDownloader:Win32/Small.gen!AZ

Posted: August 10, 2011

TrojanDownloader:Win32/Small.gen!AZ is a predominantly Chinese dropper Trojan that installs other harmful programs, potentially including spyware, rogue security products, browser hijackers or viruses. SpywareRemove.com malware experts have also observed TrojanDownloader:Win32/Small.gen!AZ making various security attacks for the purpose of contacting remote servers, including altering firewall settings. Since TrojanDownloader:Win32/Small.gen!AZ is a generic label that can be applied to many similar Trojans, other symptoms may vary widely, but all TrojanDownloader:Win32/Small.gen!AZ infections should be considered high-level PC security risks. You should remove TrojanDownloader:Win32/Small.gen!AZ at once with a competent anti-malware scanner, since TrojanDownloader:Win32/Small.gen!AZ will make Registry changes and may be installed with other infections that require complete system scans to remove.

How to Catch TrojanDownloader:Win32/Small.gen!AZ Before It's Too Late

With a modest spread of infections from 2009 to 2011, TrojanDownloader:Win32/Small.gen!AZ may be old, but it's also a still-viable threat to any Windows computer's security. You can protect your PC against possible TrojanDownloader:Win32/Small.gen!AZ infections by keeping all relevant security, script and web-browsing software up-to-date. Since TrojanDownloader:Win32/Small.gen!AZ Trojans have been known to install themselves automatically via ActiveX exploits, you should be particularly careful to keep ActiveX scripts updated to close such vulnerabilities.

Although TrojanDownloader:Win32/Small.gen!AZ will try to install itself without being seen and keep its activities hidden, SpywareRemove.com malware researchers have found the following typical signs of TrojanDownloader:Win32/Small.gen!AZ activity that can be observed:

All TrojanDownloader:Win32/Small.gen!AZ infections will attempt to make contact with remote servers or criminal entities, by communicating through your network ports. In many cases, TrojanDownloader:Win32/Small.gen!AZ may open network ports to accomplish this. If necessary, TrojanDownloader:Win32/Small.gen!AZ may also change your firewall settings, especially by adding an exception for its own .exe file.
As a dropper Trojan, TrojanDownloader:Win32/Small.gen!AZ will always try to install other harmful programs. These payloads can vary almost infinitely depending on the variant of TrojanDownloader:Win32/Small.gen!AZ and configuration information. However, SpywareRemove.com malware researchers have found that the most popular dropper Trojan payloads tend to be rogue security programs like Advanced Spyware Detector and spyware such as Trojan-PSW.VBS.Half that prefer to steal passwords and other private data.
Recent TrojanDownloader:Win32/Small.gen!AZ infections have a marked tendency to create easily-visible .tmp processes that can be seen in Windows Task Manager. These TrojanDownloader:Win32/Small.gen!AZ processes will start automatically, and SpywareRemove.com malware analysts recommend finding a work-around to this (such as Safe Mode) prior to trying to remove TrojanDownloader:Win32/Small.gen!AZ.

Putting an End to TrojanDownloader:Win32/Small.gen!AZ Before Its Payload Ends Your PC

Even though recent TrojanDownloader:Win32/Small.gen!AZ files are often found in the Temp folder, deleting TrojanDownloader:Win32/Small.gen!AZ files shouldn't be done, except with the help of a suitable anti-virus or other security program. Since TrojanDownloader:Win32/Small.gen!AZ, regardless of which variant it is, always makes various system changes and Windows Registry alterations, you should use security software to revert these unwanted side effects of TrojanDownloader:Win32/Small.gen!AZ infection.

TrojanDownloader:Win32/Small.gen!AZ is also known by the alias Gen:Trojan.Heur.PT.1020DFCFCF and may be installed along with other harmful applications. Some related infections that SpywareRemove.com malware experts have found accompanying TrojanDownloader:Win32/Small.gen!AZ include Trojan-Downloader.Win32.Agent.elsm, Dropper/Malware.121856.AX, Trojan:Win32/Pirpi.A and Packed.Win32.Katusha.b.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%Temp%\win1.tmp

File name: %Temp%\win1.tmp
File type: Temporary File
Mime Type: unknown/tmp

%Temp%\CoreServices.exe

File name: %Temp%\CoreServices.exe
File type: Executable File
Mime Type: unknown/exe

%Temp%\[RANDOM CHARACTERS]

File name: %Temp%\[RANDOM CHARACTERS]

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]CoreServices = "%Temp%\CoreServices.exe"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig\DEBUG]Trace Level = ""