Trojan-Dropper.Win32.Small.rd

Technical Details

This Trojan is designed to install other Trojan programs to the victim machine without the knowledge or consent of the user. The Trojan itself is a Windows PE EXE file 27,648 bytes in size.

Payload

Once launched, the Trojan copies itself to the Windows system directory under its original file name:

It then registers itself in the system registry:

This ensures that the Trojan will be launched each time Windows is booted on the victim machine.

Once launched, the Trojan copies itself to the Windows system directory as "dload.exe":

Kaspersky Anti-Virus will detect this file as Trojan-Downloader.Win32.Delf.dg

This file will then be launched for execution.

Removal instructions

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
2. Delete the following files:
   %System%\<original Trojan file name>
   %System%\dload.exe
3. Delete the following entries from the system registry:
   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Windows Service" = "%System%\<original Trojan file name>"
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus)