Troj/Small-DL

Please follow the instructions for removing Trojans.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Shell
open32.exe

and delete it if it exists.

Close the registry editor.

Troj/Small-DL is a Trojan for the Windows platform.

Troj/Small-DL connects to a preconfigured internet site and attempts to download data. The Trojan then displays this as an HTML page in an attempt to lure users into using the links displayed in the page.

Troj/Small-DL copies itself to the Windows system folder with the filename "open32.exe" and creates the file "open32_uninstall.exe". The HTML file "open32.conf" may also be created in the system folder.

The Trojan creates the following registry entries in order to run itself automcatically on computer login:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Shell
open32.exe

Troj/Small-DL creates the following uninstall registry entries:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Open32\
DisplayName
Windows open32 update

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Open32\
UninstallString
open32_uninstall.exe

The uninstallation program does not remove any files from the computer, merely the registry entry listed above.