Troj/Small-EM

Aliases	Trojan-Dropper.Win32.Small.abm MultiDropper-NH
Category	Viruses and Spyware
Type	Trojan
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Drops more malware Installs itself in the registry
Protection available since	28 June 2005 22:33:34 (GMT)
Detected by	All Sophos products

Free virus scan
Download the Threat Detection Test

Troj/Small-EM is a Trojan for the Windows platform.

Troj/Small-EM creates the file <Windows system folder>\svcsys.dll and may copy itself to the Windows system folder.

The following registry entry is created to run code exported by the Trojan library on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
SvcSys
{5570B116-706A-4632-98F8-C5433DE21D4D}

The file svcsys.dll is registered as a COM object, creating registry entries
under:

HKCR\CLSID\{5570B116-706A-4632-98F8-C5433DE21D4D}

The following registry entry may also be created on some systems:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SvcSys
<Windows system folder>\<executable>

Get reports about the latest virus and spyware threats delivered to your computer