Troj/Small-AW drops and loads a DLL file detected by Sophos Anti-Virus as Troj/Mahru-A.
Troj/Small-AW creates a copy of itself in the Windows system folder with the filename scvhosts.exe and creates the following registry entries so that the Trojan is run when Windows starts up:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = scvhosts.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = scvhosts.exe
The dropped Trojan will be created in the Windows system folder with the filename rwtrisfg32.dll.