Trojan-Dropper.Win32.VB.oj

Technical Details

This Trojan is designed to install other Trojan programs to the victim machine without the knowledge or consent of the user. It is a Windows PE EXE file. It is 53 248 bytes in size. It is written in Visual Basic.

Payload

When launched the Trojan extracts a file from its body and saves it to C: as:

This file is 5 672 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan-Downloader.Win32.VB.arg.

The Trojan then extracts a file called "ok2.exe" to C:

This file is 24 576 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan-Downloader.Win32.Agent.bbv.

Once the files have been successfully extracted they will be launched for execution.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine). Delete all files created by the Trojan:
C:\ok1.exe
C:\ok2.exe
1. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).