Trojan-Dropper.Win32.Small.wb

Technical Details

This Trojan installs other malicious programs to the victim machine. It is a Windows PE EXE file. It is 17213 bytes in size. It is packed using FSG. The unpacked file is approximately 103KB in size. It is written in C++.

Payload

When launching, the Trojan extracts two files from its body and saves them as follows:

This file is 30000 bytes in size.

This file is 35000 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan-Downloader.Win32.Druser.g.

The Trojan then registers the following file in the system: "%System%\performent003.dll".

The Trojan also drops a batch file to its working directory and launches it. It then ceases running. This file will delete the original Trojan file and its body.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Revert the registration of "%System%\performent003.dll" by running the following command:
   Regsvr32.exe /u performent003.dll
2. Delete the following files:
   %System%\kempersoi32.dll
   %System%\performent003.dll
3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).