W32/Small.AXR

 Information about the W32/Small.AXR Trojan:

W32/Small.AXR is a trojan. The trojan will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the W32/Bobax infected system.

The subject of the infected email will be any one of the following;

God Bless the USA!
Finally!
Captured..
He has been captured...

The body of the infected email will be any one of the following;

Xmong. Npos alter. almonsted nocks

Turn on your TV. Osama Bin Laden has been captured. While CNN has no pictures at this point of time, the military channel (PPV) released some pictures. I managed to capture a couple of these pictures off my TV. Ive attached a slideshow containing all the pictures I managed to capture. I apologize for the low quality, its the best I could do at this point of time. Hopefully CNN will have pictures and a video soon. God bless the USA! Stephen Christensen

It carries any one of the following infected attachments;

pics.zip
teamster.zip
usurus.zip
toxicology.zip

Upon execution of the infected attachment, the trojan attempts to connect to some websites from a pre-configured list maintained by the trojan. On successful connection, the trojan tries to download and execute a file which is detected W32/Bobax worm.

This worm first appeared on June 3, 2005.

 Other names of W32/Small.AXR Worm:

This Worm is also known as TROJ_SMALL.AHE, Downloader-ABL, Download.BBX.