Trojan-Dropper.Win32.Small.hy

Technical Details

This Trojan is designed to install and launch other programs on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 27648 bytes in size. It is packed using UPX. The unpacked file is approximately 67KB in size. It is written in C++.

Payload

When launching, the Trojan terminates the "sichost.exe" process. The Trojan then extracts a number of files from its body and saves them under the following names:

This file is 6144 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan-Clicker.Win32.Small.bh.

This file is 11000 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan-Proxy.Win32.Daemonize.u.

This file is 35000 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan-Proxy.Win32.Daemonize.t.

In order to ensure that the Trojan is launched automatically each time the system is booted, it adds a link to %WinDir%\sichost.exe" to the system registry:

"%WinDir%\sichost.exe" will then be launched for execution and the Trojan will cease running.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).

2. Delete the following files:

   %WinDir%\sichost.exe
   %System%\sichosts.exe
   %System%\sichostc.exe

   Delete the following system registry key parameter:

   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   "Adline Ssystem" = "%WinDir%\sichost.exe"

3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).