Trojan:Win32/Sideloader.B represents a sophisticated class of malware that exploits a technique called DLL side-loading to execute malicious code on Windows systems. Rather than acting as a traditional standalone executable, this trojan leverages legitimate signed applications to load malicious dynamic-link libraries, making detection significantly more challenging for standard antivirus software. The technique capitalizes on how Windows searches for and loads DLL files, allowing attackers to place malicious libraries in locations where trusted programs will inadvertently execute them.
This threat family has been observed in targeted attacks and broader distribution campaigns alike, often serving as a first-stage loader that downloads additional payloads once established on a victim's machine. What makes Sideloader.B particularly concerning is its ability to hide behind the digital signatures of legitimate software, effectively using trusted applications as unwitting accomplices in the infection chain.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Family | Trojan-Downloader / Loader |
| Common Aliases | Win32/Sideloader.B, Trojan.Sideloader, DLL Hijack Trojan |
| Primary Platform | Windows 7/8/10/11 (all editions) |
| Discovery Period | Active variants since 2018; B variant identified 2020-2021 |
| Distribution Methods | Bundled software, fake updates, phishing attachments, exploit kits |
| Persistence Mechanism | DLL side-loading via legitimate signed executables, scheduled tasks, Run registry keys |
| Primary Capabilities | Payload delivery, secondary malware installation, command execution, persistence establishment |
| Typical Artifacts | Misnamed DLLs in application directories, scheduled tasks referencing legitimate binaries, unexpected executables in %LOCALAPPDATA% |
| Network Behavior | HTTPS connections to C2 servers, often masquerading as legitimate update checks; payload downloads from compromised or attacker-controlled domains |
| Data at Risk | System information, credentials, banking data (depends on secondary payload) |
| Removal Difficulty | Moderate to High — requires identifying both the loader and any secondary infections |
| Reinfection Risk | High if the initial infection vector (bundled software, browser vulnerability) remains unaddressed |
How It Spreads
Trojan:Win32/Sideloader.B typically arrives on systems through deceptive distribution channels that exploit user trust or inattention. The most common infection vector involves software bundling, where the trojan components are packaged alongside seemingly legitimate free applications downloaded from third-party websites. Users who rush through installation wizards without examining each screen may inadvertently agree to install "additional components" that include the malicious DLL and its companion legitimate executable.
Phishing campaigns represent another significant distribution method. Attackers craft emails that appear to come from shipping companies, financial institutions, or even IT departments, containing attachments that claim to be invoices, tracking documents, or security updates. These attachments may be ZIP archives containing both a legitimate signed executable and a malicious DLL configured to be loaded by that executable when run. Once the victim extracts and opens the "document," the side-loading process begins automatically.
The threat also propagates through fake software updates and download portals. Users searching for popular applications, media codecs, or system utilities may encounter websites offering downloads that bundle Sideloader.B components. In some cases, the malware exploits vulnerabilities in outdated browser plugins or operating system components to achieve initial execution without requiring explicit user action.
- Software bundling — Hidden in free application installers, particularly from unofficial download sites
- Phishing emails — Attachments disguised as business documents, shipping notifications, or invoices
- Fake update prompts — Bogus notifications claiming Java, Flash, or browser updates are required
- Malicious advertisements — Drive-by downloads from compromised advertising networks on legitimate websites
- Peer-to-peer networks — Bundled with cracked software or key generators on torrent sites
- Compromised downloads — Legitimate software installers replaced with trojanized versions on hacked hosting servers
- USB drives — Autorun-enabled infections spreading through shared removable media
What It Does On Your Machine
Once executed, Trojan:Win32/Sideloader.B establishes itself through the DLL side-loading technique, which exploits the Windows DLL search order. The infection typically consists of two components: a legitimate signed executable (often renamed or placed in an unexpected location) and a malicious DLL with a name that matches a library the legitimate program expects to load. When the legitimate executable runs, Windows searches for its required DLLs and finds the malicious one first due to search-order precedence. This allows the trojan code to execute within the context of a trusted, signed application, bypassing many security checks.
The primary function of Sideloader.B is to download and execute additional malware payloads. After achieving initial execution, it typically contacts command-and-control servers to retrieve instructions and secondary components. These secondary infections vary widely but commonly include information stealers, banking trojans, ransomware, or cryptocurrency miners. The modular nature of this approach allows attackers to customize the payload based on the infected system's value or the current campaign objectives. The trojan often performs reconnaissance first, collecting system information, installed software lists, and network configuration details before determining which payloads to deploy.
To maintain persistence across reboots, variants in this family employ multiple techniques. The most common involves creating scheduled tasks that execute the legitimate-appearing binary (which then loads the malicious DLL) at system startup or at regular intervals. Some variants also modify registry Run keys or install themselves as services. Because the persistence mechanism launches a digitally signed executable rather than an obviously suspicious file, many users and even security software overlook the anomaly during routine scans.
├── legitimate_app.exe # Signed executable (often renamed)
└── version.dll # Malicious DLL (side-loaded)
C:\ProgramData\WindowsSupport\
├── update_service.exe # May be legitimate binary
└── wtsapi32.dll # Malicious replacement for system DLL
Registry Keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
"SystemUpdate" = "C:\Users\[User]\AppData\Local\{GUID}\legitimate_app.exe"
Scheduled Tasks:
\Microsoft\Windows\AppIntegrity\SystemMaintenance
Triggers: At logon, Daily at 3:00 AM
Action: C:\ProgramData\WindowsSupport\update_service.exe
The infection also frequently modifies browser settings and installs additional browser extensions to facilitate ad injection, search hijacking, or credential theft. Users may notice increased system resource usage, particularly network bandwidth consumption as the trojan communicates with remote servers and downloads additional components. In many cases, however, Sideloader.B operates quietly in the background, designed to remain undetected for as long as possible while serving as a persistent foothold for attackers.
Manual Removal — Step by Step
Disconnect From All Networks Immediately
Before attempting any removal steps, physically disconnect your computer from the internet by unplugging the Ethernet cable or disabling Wi-Fi. This prevents the trojan from downloading additional payloads, receiving new instructions from command-and-control servers, or potentially spreading to other devices on your network. If you're on a business network, inform your IT department immediately before proceeding.
Boot Into Safe Mode With Networking
Restart your computer and boot into Safe Mode with Networking to prevent most non-essential drivers and startup items from loading, including many malware persistence mechanisms. On Windows 10/11, hold Shift while clicking Restart, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart, and press F5 when the options appear. Safe Mode provides a cleaner environment for removal and prevents the trojan from actively defending itself.
Identify and Terminate Malicious Processes
Open Task Manager (Ctrl+Shift+Esc) and examine running processes carefully. Look for unfamiliar executables running from AppData, ProgramData, or Temp directories. Sideloader variants often disguise themselves as legitimate Windows processes but with subtle misspellings or unexpected file locations. Right-click suspicious processes, select "Open file location," and note the full path before terminating them. Be cautious — some legitimate processes also run from these locations, so research any process you're uncertain about before ending it.
Remove Persistence Mechanisms
Open the Registry Editor (type regedit in the Start menu) and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Look for entries that reference executables in unusual locations, particularly in AppData\Local subfolders with random names or GUIDs. Delete suspicious entries, but document them first. Then open Task Scheduler (type taskschd.msc) and examine all scheduled tasks, particularly those under Microsoft\Windows branches that seem out of place or reference executables in user directories. Delete any tasks associated with the identified malicious files.
Delete the Malicious Files and Folders
Navigate to the file locations you identified in previous steps. Common locations include C:\Users\[YourUsername]\AppData\Local\[random-GUID]\ and C:\ProgramData\[vendor-sounding-name]\. Delete the entire folder containing both the legitimate executable and the side-loaded DLL. If Windows prevents deletion due to the file being in use, ensure you've terminated all related processes in Task Manager first. You may need to reveal hidden files (View > Hidden items in File Explorer) to see AppData folders.
Run a Reputable Anti-Malware Scanner
Download and install Malwarebytes (from the official malwarebytes.com site only) and run a full system scan. Sideloader infections frequently install secondary payloads that manual removal might miss. Let the scanner complete fully even if it takes several hours, then review and remove all detected threats. Follow up with a Windows Defender full scan as a second opinion. These tools often detect variants or components that weren't obvious during manual inspection.
Reset Browser Settings and Remove Extensions
Sideloader trojans commonly install malicious browser extensions or modify settings. In Chrome, Edge, or Firefox, navigate to the extensions/add-ons page and remove any unfamiliar items, especially those installed recently without your knowledge. Then reset browser settings to default: in Chrome, go to Settings > Reset and clean up > Restore settings to their original defaults. This removes hijacked homepages, search engines, and startup pages while preserving bookmarks and passwords.
Check for Secondary Infections
Review your installed programs list (Settings > Apps > Apps & features) for unfamiliar software installed around the time symptoms appeared. Uninstall anything suspicious. Check browser homepages, default search engines, and proxy settings in Internet Options. Examine your email sent folder for messages you didn't send, which could indicate credential theft. If you find evidence of data theft, proceed immediately to step 9.
Change Passwords From a Clean Device
If the infection had sufficient time to operate (more than a few hours), assume credentials may have been compromised. From a different, known-clean device or smartphone, change passwords for critical accounts: email, banking, shopping sites, and especially any accounts used on the infected computer. Enable two-factor authentication wherever possible. Do not change passwords from the infected machine until you've completed all removal steps and verified the system is clean.
Reboot Normally and Verify Removal
Restart your computer normally (not in Safe Mode) and reconnect to the internet. Monitor system behavior for 24-48 hours. Watch for unusual network activity, unexpected CPU usage, or the reappearance of suspicious processes. Run another Malwarebytes quick scan after the normal reboot to confirm nothing re-established itself. If symptoms return or you're uncertain about complete removal, professional verification is strongly recommended — incomplete removal often leads to reinfection within days.
Prevention
- Download software only from official sources. Avoid third-party download sites that bundle additional software with legitimate applications. Always obtain software directly from the publisher's website or the Microsoft Store. When you must use a third-party site, carefully read each screen during installation and decline any "recommended" additional software.
- Keep Windows and all software updated. Enable automatic updates for Windows, and regularly update all installed applications, especially browsers, Java, and Adobe products. Many infections exploit vulnerabilities in outdated software. Uninstall software you no longer use to reduce your attack surface.
- Maintain real-time antivirus protection. Keep Windows Defender enabled (it's quite capable) or use a reputable third-party solution, and ensure it's configured for real-time protection. Schedule regular full-system scans weekly. Don't disable your antivirus to install software — if an installer requires this, the software is almost certainly malicious.
- Exercise extreme caution with email attachments. Never open attachments from unexpected emails, even if they appear to come from known contacts (their accounts may be compromised). Be especially wary of ZIP files, executables, and documents that prompt you to "enable macros" or "enable content." When in doubt, contact the sender through a different communication channel to verify they sent the attachment.
- Use a standard user account for daily activities. Don't operate your computer with administrator privileges for routine tasks. Create a standard user account for everyday use and only elevate to administrator when explicitly required for legitimate software installation. This limits malware's ability to make system-wide changes.
- Enable folder and file extension visibility. Configure Windows to show file extensions (File Explorer > View > File name extensions) so you can identify suspicious files like "invoice.pdf.exe" that masquerade as documents. This simple setting prevents many social-engineering attacks.
- Implement browser security measures. Install an ad-blocker and script-blocker extension like uBlock Origin to reduce exposure to malicious advertisements and drive-by downloads. Configure your browser to ask before downloading files and to warn about potentially dangerous files. Avoid clicking ads for downloads — instead, type URLs directly into the address bar.
- Back up important data regularly. Maintain regular backups of critical files to an external drive that's disconnected when not backing up, or use a reputable cloud backup service. This won't prevent infection, but it ensures you can recover if malware causes data loss or if you need to completely wipe and reinstall Windows to eliminate a persistent infection.
When Computer Repair Roswell handles your Trojan:Win32/Sideloader.B removal, we guarantee your system stays clean for 90 days. If any trace of the infection reappears within three months, bring it back and we'll re-clean it at no charge. We don't just delete files — we verify complete removal, check for secondary infections, and ensure all persistence mechanisms are eliminated. That's the difference between a thorough professional cleaning and a quick scan that leaves remnants behind.
Bring It In
While the manual removal steps above can be effective for technically comfortable users, Trojan:Win32/Sideloader.B infections are often more complex than they initially appear. The trojan's primary purpose is downloading additional malware, which means by the time you've detected it, your system may already be harboring multiple infections — some designed specifically to hide from scans and resist removal. A single missed registry key or orphaned DLL can allow the infection to re-establish itself within hours, wasting your time and leaving your data at risk.
Computer Repair Roswell has handled hundreds of sideloader infections in the Roswell and North Atlanta area. We use professional-grade tools and systematic verification procedures to ensure complete removal, not just of the initial trojan but of any secondary payloads it may have installed. Most infections are fully resolved the same day, and our 90-day warranty gives you peace of mind that the problem is truly solved. Call us at (770) 679-3301 or stop by our location at 1000 Mansell Exchange West, Roswell, GA 30076. We're open Monday through Friday and offer free diagnostics to assess the full extent of any infection — no guesswork, no recurring charges, just thorough professional service that gets your computer back to normal.