Trojan-Dropper.Win32.Small.aw

Technical Details

This Trojan is designed to install and launch other programs on the victim machine. It is a Windows PE EXE file. The file is approximately 40KB in size.

Installation

When launched, the Trojan copies its executable file to the Windows system directory under the following name:

%System%\scvhosts.exe

Payload

The Trojan also extracts the following DLL file from its body:

• %System%\rwtrisfg32.dll — this file is 78,848 bytes in size, and will be detected by Kaspersky Anti-Virus as Backdoor.Win32.SpyBoter.aq.

The Trojan then loads this DLL into the explorer.exe process address space and ceases running.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
2. Delete the files created by the Trojan:

   %System%\scvhosts.exe
   %System%\rwtrisfg32.dll

3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).