Trojan-Dropper.Win32.Small.do

Technical Details
Payload
Removal instructions

Technical Details

This Trojan installs other programs to the victim machine without the knowledge or consent of the user. It is a Windows PE EXE file. It is 36,864 bytes in size.

Payload

The Trojan also extracts the following DLL file from its body:

• %Documents and Settings%\<current user>\Application Data\Microsoft\Office\Excel10.dll — this file is 17 920 bytes in size, and will be detected by Kaspersky Anti-Virus as Trojan-Downloader.Win32.IstBar.ay

The Trojan registers the DLL in the system, launching the following process:

• regsvr32 /s %Documents and Settings%\<current user>\Application Data\Microsoft\Office\Excel10.dll

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
2. Revert the DLL file registration by executing the following command:
   • regsvr32 /u %Documents and Settings%\<cuppent user>\Application Data\Microsoft\Office\Excel10.dll
3. Delete the file created by the Trojan:
   • %Documents and Settings%\<current user>\Application Data\Microsoft\Office\Excel10.dll
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).