SMSS.EXE – Trojan Small

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Free Download
Fully Functional 30-day Trial. No credit card is required.
Reviews
. EULA. Privacy Policy. Uninstall.

SMSS.EXE – Trojan Small removal

FileMD5Virus Alias
SMSS.EXE 03d370bf9d860645cbbe67d515150f57 Trojan Small
SMSS.EXE 03d370bf9d860645cbbe67d515150f57 Trojan Artemis
SMSS.EXE 03d370bf9d860645cbbe67d515150f57 Trojan Generic
SMSS.EXE 03d370bf9d860645cbbe67d515150f57 Trojan Eldorado
SMSS.EXE 03d370bf9d860645cbbe67d515150f57 Trojan Downloader
SMSS.EXE 03d370bf9d860645cbbe67d515150f57 Trojan Agent

SMSS.EXE size: 472064 bytes
SMSS.EXE hash: 03D370BF9D860645CBBE67D515150F57

Created files:

%WinDir%\System\rsvp.exe
%UserProfile%\Local Settings\Application Data\Microsoft\cisvc.exe
%UserProfile%\Local Settings\Application Data\Microsoft\clipsrv.exe
%UserProfile%\Local Settings\Application Data\smss.exe
%TEMP%\Twain002.Mtx
%WinDir%\winlogon.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cisvc: %Local AppData%\Microsoft\cisvc.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Session Manager: %WinDir%\System32\config\SYSTEM~1\LOCALS~1\APPLIC~1\smss.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ClipSrv: %Local AppData%\Microsoft\clipsrv.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinLogon: %WinDir%\winlogon.exe

Detected by UnHackMe:

SMSS.EXE
Default location: %LOCAL APPDATA%\SMSS.EXE

Dropper information:
MD5: 03d370bf9d860645cbbe67d515150f57
File size: 472064 bytes

Leave a Reply