Trojan-Dropper.Win32.Small.bc

Technical Details

This Trojan program installs other Trojan programs to the victim machine without the user's knowledge or consent. The main Trojan file is a Windows PE EXE file 24064 bytes in size, packed using UPX. The unpacked file is approximately 60KB in size.

Payload

Once launched, the Trojan copies itself to the Windows system registry as nstask32.exe:

%System%\nstask32.exe

It then registers this file in the system registry, ensuring that the Trojan will be launched each time Windows is rebooted on the victim machine:

When launching, the Trojan also drops a file called winsockdrv.dll to the Windows system directory:

%System%\win32sockdrv.dll

This file will be detected by Kaspersky Anti-Virus as Backdoor.Win32.SdBot.at.

The file will then be launched for execution:

The Trojan also creates the following file:

%System%\dllcache\tftp.exe

The original executable file will then be deleted.

Removal instructions

1. Delete the files listed below:

   %System%\nstask32.exe
   %System%\win32sockdrv.dll
   %System%\dllcache\tftp.exe

2. Delete the following values from the system registry:

   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Runonce]
    "NDplDeamon"="nstask32.exe"

   [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    Shell="Explorer.exe nstask32.exe"

3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).