Troj/Small-DLH is a Trojan for the Windows platform.
Troj/Small-DLH includes functionality to access the internet and communicate with a remote server via HTTP.
When first run Troj/Small-DLH copies itself to <Windows>\svchost.exe and creates the following files:
<Temp>\Sys.htm
<Temp>\cc1.txt
<Windows>\syshost.dll
syshost.dll is also detected as Troj/Small-DLH and is used to hide files, processes and registry entries related to the Trojan. The other files are harmless and can be deleted safely.
The following registry entry is created to run Troj/Small-DLH on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
1
<Windows>\svchost.exe
Registry entries are created under:
HKLM\SOFTWARE\0D92R7F92J\