Trojan-Dropper.Win32.Small.at

Technical Details

This Trojan is designed to install and launch other malicoius programs on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 665,120 bytes in size.

Payload

Once launched, the Trojan extracts the files listed below to the Window temporary directory and launches them:

• %Temp%\~1.exe – this file is 18,163 bytes in size, and will be detected by Kaspersky Anti-Virus as Trojan-Spy.Win32.Fearless.10
• %Temp%\~2.exe - this file is 68,180 bytes in size, and will be detected by Kaspersky Anti-Virus as Backdoor.Win32.Beastdoor.192.h
• %Temp%\~3.exe - this file is 573,952 bytes in size, and will be detected by Kaspersky Anti-Virus as Trojan-Spy.Win32.Wmbug.101

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process:
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the files extracted from the Trojan’s body:

   %Temp%\~1.exe
   %Temp%\~2.exe
   %Temp%\~3.exe

4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).