Trojan-Dropper.Win32.VB.or

Technical Details

This Trojan is designed to install other Trojan programs to the victim machine without the knowledge or consent of the user. It is a Windows PE EXE file. It is 863 881 bytes in size. It is written in Visual Basic.

Payload

Once launched, the Trojan extracts a file called "1.tmp" from its body to the current user's Windows temporary directory:

The Trojan then extracts a file called "2.tmp" to the current user's temporary directory:

This file is 774 171 bytes in size. It will be detected by Kaspersky Anti-Virus as Backdoor.Win32.Hupigon.gs.

Once the files have been successfully extracted they will be launched for execution.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
2. Delete all files created by the Trojan:
   %Temp%\1.tmp
   %Temp%\2.tmp
3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).