Trojan-Dropper.Win32.Small.es

Technical Details

This Trojan is designed to install and launch other malicious programs on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 10240 bytes in size. It is packed using UPX. The unpacked file is approximately 42KB in size. It is written in C++.

Payload

When launching, the Trojan searches for and terminates all processes called "svchost.exe". The Trojan then extracts a number of files from its body and saves them under the following names:

This file is 14336 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan-Spy.Win32.Tofger.w.

This file is 7680 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan-PSW.Win32.Small.j.

This file is 3072 bytes in size. It will be detected by Kaspersky Anti-Virus as Trojan-Spy.Win32.Tofger.j.

The Trojan then writes the following string:

to the file shown below:

In order to ensure that the Trojan is launched automatically each time the system is booted, it adds a link to %WinDir%\svchost.exe" to the system registry:

"%WinDir%\svchost.exe" will then be launched for execution and the Trojan will cease running.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
2. Delete the following files:

   %WinDir%\svchost.exe
   %System%\wmini.exe
   %WinDir%\msin32.dll

3. Delete the following system registry key parameter:
   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   "Online Service" = "%WinDir%\svchost.exe"
4. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).