Trojan-Dropper.Win32.Small.wz

Technical Details

This Trojan is designed to install and launch other programs on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 10313 bytes in size. It is packed using FSG. The unpacked file is approximately 53KB in size. It is written in C++.

Payload

When launching, the Trojan extracts two files from its body and saves them as follows:

This file is 9216 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan.Win32.Small.av.

This file is 4377 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan-Downloader.Win32.Small.aun.

The Trojan also creates the following system registry key:

The Trojan will then launch "%System%\winserve.exe" for execution and cease running.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
2. Delete the following files:
   %System%\rsv32.dll
   %System%\winserv.exe
3. Delete the following system registry keys: (see What is a system registry and how do I use it for details on how to edit the registry).
   [HKLM\Software\Auogu]
   "h" = "205.209.185.137/admin/"
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).