Troj/Small-HS

Category: Viruses and Spyware
Type: Trojan
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

Troj/Small-HS is a Trojan which attempts to load a pop-up HTML page each time a user logs onto the computer.

In order to load the remote HTML page Troj/Small-HS temporarily modifies internet security settings and then launches Microsoft Internet Explorer.

When first run Troj/Small-HS copies itself to &ltSystem&gt\gxlib.exe.

The following registry entry is created to run gxlib.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
vmcleaner
gxlib.exe

Whilst active Troj/Small-HS temporarily sets the following registry entry, affecting internet security:

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
CurrentLevel
&ltnon zero value&gt

Troj/Small-HS remains active until it has succeeded in loading the remote HTML page.