Trojan-Dropper.Win32.VB.me drops multiple copies of itself to saved download folders of known Peer-to-Peer applications.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
The malware's behavior primarily involves the use of peer-to-peer (P2P) applications. It initially checks for the existence of the following P2P configuration files and registry configuration to get the Directory where the downloaded files were kept:
It then queries the following P2P application executables and executes them if they exist:
By design, it will initially just check for a LimeWire installation. Checking for BearShare, Morpheus, Morpheus Ultra, and Shareaza will be done after checking if any of the following executables: bearshare.exe, morpheus.exe, or shareaza.exe are running in the processes. It then adds a hidden "_" folder in location where the default Saved folder is located. To continue, it first checks if it is running as %alluserstartup%\wmplayer.exe. If no, it generates a message box then exits:
If yes, it check to see if any of the following files exist in the system directory:
If the files are not found it drops and execute %windows%\b.exe. It locks the following system tools to prevent easy removal of the malware:
Attempt to execute the said tools prompts a message box:
It then drops a copy of itself as "yesyesyesyes.exe" to the saved directory of the target psp app inside the created "_" folder. It downloads the page:
It parses through file to get music or video titles, usually containing the most recent ones. Using these names it then creates a copy of itself on the saved download folders.