Threat description
Trojan-Dropper.Win32.VB.me drops multiple copies of itself to saved download folders of known Peer-to-Peer applications.
Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.
More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.
You may also refer to the Knowledge Base on the F-Secure Community site for more information.
F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.
The malware's behavior primarily involves the use of peer-to-peer (P2P) applications. It initially checks for the existence of the following P2P configuration files and registry configuration to get the Directory where the downloaded files were kept:
It then queries the following P2P application executables and executes them if they exist:
By design, it will initially just check for a LimeWire installation. Checking for BearShare, Morpheus, Morpheus Ultra, and Shareaza will be done after checking if any of the following executables: bearshare.exe, morpheus.exe, or shareaza.exe are running in the processes. It then adds a hidden "_" folder in location where the default Saved folder is located. To continue, it first checks if it is running as %alluserstartup%\wmplayer.exe. If no, it generates a message box then exits:
If yes, it check to see if any of the following files exist in the system directory:
If the files are not found it drops and execute %windows%\b.exe. It locks the following system tools to prevent easy removal of the malware:
Attempt to execute the said tools prompts a message box:
It then drops a copy of itself as "yesyesyesyes.exe" to the saved directory of the target psp app inside the created "_" folder. It downloads the page:
It parses through file to get music or video titles, usually containing the most recent ones. Using these names it then creates a copy of itself on the saved download folders.
Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis
Give advice. Get advice. Share the knowledge on our free discussion forum.