TROJ_ZEROML.QR
PAK:UPX, ARC:InstallCreator, ARC:[bb.chm]:CHM (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt); Adware:W32/Eshoper (FSecure)
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
748,659 bytes
EXE
Yes
19 Feb 2012
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan creates the following folders:
- %Program Files%\Brain Bullet!
- %Program Files%\Brain Bullet!\Icons
- %Program Files%\Brain Bullet!\Music
- %Program Files%\Brain Bullet!\Plugins
- %Start Menu%\Programs\Brain Bullet!
(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.)
Autostart Technique
This Trojan adds the following registry entries to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Brain Bullet = "%Program Files%\BRAINB~1\bb.exe"
Other System Modifications
This Trojan deletes the following files:
- %Program Files%\Brain Bullet!\Uninstall.exe
- %Program Files%\Brain Bullet!\bb.ini
- %Program Files%\Brain Bullet!\bb.chm
- %Program Files%\Brain Bullet!\Version History.txt
- %Program Files%\Brain Bullet!\Readme.txt
- %Program Files%\Brain Bullet!\Icons\16.ico
- %Program Files%\Brain Bullet!\Icons\32.ico
- %Program Files%\Brain Bullet!\Icons\48.ico
- %Program Files%\Brain Bullet!\Icons\Thumbs.db
- %Program Files%\Brain Bullet!\Music\Jesus Joy of Man.mid
- %Program Files%\Brain Bullet!\Music\Minuet 1.mid
- %Program Files%\Brain Bullet!\Music\Minuet 2.mid
- %Program Files%\Brain Bullet!\Music\Minuet 3.mid
- %Program Files%\Brain Bullet!\Music\Musette.mid
- %Program Files%\Brain Bullet!\Music\Rameau.mid
- %Program Files%\Brain Bullet!\Music\Telemann.mid
- %Program Files%\Brain Bullet!\Music\BJSF 1.mid
- %Program Files%\Brain Bullet!\Music\BJSF 5.mid
- %Program Files%\Brain Bullet!\Music\Couper 1.mid
- %Program Files%\Brain Bullet!\Music\Couper 2.mid
- %Program Files%\Brain Bullet!\Plugins\Accepting Criticism, Listening To Others.txt
- %Program Files%\Brain Bullet!\Plugins\Instant Memory Bank!.txt
- %Program Files%\Brain Bullet!\Plugins\Control Your Dreams At Night.txt
- %Program Files%\Brain Bullet!\Plugins\I Love Today.txt
- %Program Files%\Brain Bullet!\Plugins\Being a Great Parent.txt
- %Program Files%\Brain Bullet!\Plugins\Ultimate Leadership Skills.txt
- %Program Files%\Brain Bullet!\Plugins\The Supreme Athlete.txt
- %Program Files%\Brain Bullet!\Plugins\Pass Your Exams!.txt
- %Program Files%\Brain Bullet!\Plugins\Dissolve Stress & Tension.txt
- %Program Files%\Brain Bullet!\Plugins\Superior Decision Making.txt
- %Program Files%\Brain Bullet!\Plugins\Super Positivity.txt
- %Program Files%\Brain Bullet!\Plugins\Breathe Relief From Allergies.txt
- %Program Files%\Brain Bullet!\Plugins\The Virtue of Patience.txt
- %Program Files%\Brain Bullet!\Plugins\Achieve Ultimate Success.txt
- %Program Files%\Brain Bullet!\Plugins\Rocketing Your Self-Esteem.txt
- %Program Files%\Brain Bullet!\Plugins\Speed Reading.txt
- %Program Files%\Brain Bullet!\Plugins\Quit Smoking, For Good!.txt
- %Program Files%\Brain Bullet!\Plugins\You're Funny, And They Know It!.txt
- %Program Files%\Brain Bullet!\Plugins\You're a Natural Public Speaker.txt
- %Program Files%\Brain Bullet!\Plugins\Free-flowing Creative Genius.txt
- %Program Files%\Brain Bullet!\Plugins\Get What You Want, Now!.txt
- %Program Files%\Brain Bullet!\Plugins\Improve Your Marriage.txt
- %Program Files%\Brain Bullet!\Plugins\Love Yourself, Love Your Life.txt
- %Program Files%\Brain Bullet!\Plugins\Attract Your Ideal Partner.txt
- %Program Files%\Brain Bullet!\Plugins\Rapid Calm.txt
- %Program Files%\Brain Bullet!\Plugins\Super Self-Confidence.txt
- %Program Files%\Brain Bullet!\Plugins\Surging Muscle Growth!.txt
- %Program Files%\Brain Bullet!\Plugins\Free From The Past.txt
- %Program Files%\Brain Bullet!\Plugins\Get Motivated!.txt
- %Program Files%\Brain Bullet!\bb.exe
(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)
It adds the following registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Brain Bullet!
It adds the following registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Brain Bullet!
DisplayName = "Brain Bullet!"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Brain Bullet!
UninstallString = "%Program Files%\Brain Bullet!\Uninstall.exe"
Dropping Routine
This Trojan drops the following files:
- %Program Files%\Brain Bullet!\Uninstall.$$A
- %Program Files%\Brain Bullet!\bb.$$A
- %Program Files%\Brain Bullet!\Version History.$$A
- %Program Files%\Brain Bullet!\Readme.$$A
- %Program Files%\Brain Bullet!\Icons\16.$$A
- %Program Files%\Brain Bullet!\Icons\32.$$A
- %Program Files%\Brain Bullet!\Icons\48.$$A
- %Program Files%\Brain Bullet!\Icons\Thumbs.$$A
- %Program Files%\Brain Bullet!\Music\Jesus Joy of Man.$$A
- %Program Files%\Brain Bullet!\Music\Minuet 1.$$A
- %Program Files%\Brain Bullet!\Music\Minuet 2.$$A
- %Program Files%\Brain Bullet!\Music\Minuet 3.$$A
- %Program Files%\Brain Bullet!\Music\Musette.$$A
- %Program Files%\Brain Bullet!\Music\Rameau.$$A
- %Program Files%\Brain Bullet!\Music\Telemann.$$A
- %Program Files%\Brain Bullet!\Music\BJSF 1.$$A
- %Program Files%\Brain Bullet!\Music\BJSF 5.$$A
- %Program Files%\Brain Bullet!\Music\Couper 1.$$A
- %Program Files%\Brain Bullet!\Music\Couper 2.$$A
- %Program Files%\Brain Bullet!\Plugins\Accepting Criticism, Listening To Others.$$A
- %Program Files%\Brain Bullet!\Plugins\Instant Memory Bank!.$$A
- %Program Files%\Brain Bullet!\Plugins\Control Your Dreams At Night.$$A
- %Program Files%\Brain Bullet!\Plugins\I Love Today.$$A
- %Program Files%\Brain Bullet!\Plugins\Being a Great Parent.$$A
- %Program Files%\Brain Bullet!\Plugins\Ultimate Leadership Skills.$$A
- %Program Files%\Brain Bullet!\Plugins\The Supreme Athlete.$$A
- %Program Files%\Brain Bullet!\Plugins\Pass Your Exams!.$$A
- %Program Files%\Brain Bullet!\Plugins\Dissolve Stress & Tension.$$A
- %Program Files%\Brain Bullet!\Plugins\Superior Decision Making.$$A
- %Program Files%\Brain Bullet!\Plugins\Super Positivity.$$A
- %Program Files%\Brain Bullet!\Plugins\Breathe Relief From Allergies.$$A
- %Program Files%\Brain Bullet!\Plugins\The Virtue of Patience.$$A
- %Program Files%\Brain Bullet!\Plugins\Achieve Ultimate Success.$$A
- %Program Files%\Brain Bullet!\Plugins\Rocketing Your Self-Esteem.$$A
- %Program Files%\Brain Bullet!\Plugins\Speed Reading.$$A
- %Program Files%\Brain Bullet!\Plugins\Quit Smoking, For Good!.$$A
- %Program Files%\Brain Bullet!\Plugins\You're Funny, And They Know It!.$$A
- %Program Files%\Brain Bullet!\Plugins\You're a Natural Public Speaker.$$A
- %Program Files%\Brain Bullet!\Plugins\Free-flowing Creative Genius.$$A
- %Program Files%\Brain Bullet!\Plugins\Get What You Want, Now!.$$A
- %Program Files%\Brain Bullet!\Plugins\Improve Your Marriage.$$A
- %Program Files%\Brain Bullet!\Plugins\Love Yourself, Love Your Life.$$A
- %Program Files%\Brain Bullet!\Plugins\Attract Your Ideal Partner.$$A
- %Program Files%\Brain Bullet!\Plugins\Rapid Calm.$$A
- %Program Files%\Brain Bullet!\Plugins\Super Self-Confidence.$$A
- %Program Files%\Brain Bullet!\Plugins\Surging Muscle Growth!.$$A
- %Program Files%\Brain Bullet!\Plugins\Free From The Past.$$A
- %Program Files%\Brain Bullet!\Plugins\Get Motivated!.$$A
- %Start Menu%\Programs\Brain Bullet!\Uninstall Brain Bullet!.lnk
- %Start Menu%\Programs\Brain Bullet!\Brain Bullet!.lnk
- %Desktop%\Brain Bullet!.lnk
- %Program Files%\BRAINB~1\bb.ini
(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.. %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.)
This report is generated via an automated analysis system.
SOLUTION
9.200
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Step 2
Restart in Safe Mode
Step 3
Delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- Brain Bullet!
Step 4
Delete this registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- Brain Bullet = "%Program Files%\BRAINB~1\bb.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Brain Bullet!
- DisplayName = "Brain Bullet!"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Brain Bullet!
- UninstallString = "%Program Files%\Brain Bullet!\Uninstall.exe"
Step 5
Search and delete these files
- %Program Files%\Brain Bullet!\Uninstall.A
- %Program Files%\Brain Bullet!\bb.A
- %Program Files%\Brain Bullet!\Version History.A
- %Program Files%\Brain Bullet!\Readme.A
- %Program Files%\Brain Bullet!\Icons\16.A
- %Program Files%\Brain Bullet!\Icons\32.A
- %Program Files%\Brain Bullet!\Icons\48.A
- %Program Files%\Brain Bullet!\Icons\Thumbs.A
- %Program Files%\Brain Bullet!\Music\Jesus Joy of Man.A
- %Program Files%\Brain Bullet!\Music\Minuet 1.A
- %Program Files%\Brain Bullet!\Music\Minuet 2.A
- %Program Files%\Brain Bullet!\Music\Minuet 3.A
- %Program Files%\Brain Bullet!\Music\Musette.A
- %Program Files%\Brain Bullet!\Music\Rameau.A
- %Program Files%\Brain Bullet!\Music\Telemann.A
- %Program Files%\Brain Bullet!\Music\BJSF 1.A
- %Program Files%\Brain Bullet!\Music\BJSF 5.A
- %Program Files%\Brain Bullet!\Music\Couper 1.A
- %Program Files%\Brain Bullet!\Music\Couper 2.A
- %Program Files%\Brain Bullet!\Plugins\Accepting Criticism, Listening To Others.A
- %Program Files%\Brain Bullet!\Plugins\Instant Memory Bank!.A
- %Program Files%\Brain Bullet!\Plugins\Control Your Dreams At Night.A
- %Program Files%\Brain Bullet!\Plugins\I Love Today.A
- %Program Files%\Brain Bullet!\Plugins\Being a Great Parent.A
- %Program Files%\Brain Bullet!\Plugins\Ultimate Leadership Skills.A
- %Program Files%\Brain Bullet!\Plugins\The Supreme Athlete.A
- %Program Files%\Brain Bullet!\Plugins\Pass Your Exams!.A
- %Program Files%\Brain Bullet!\Plugins\Dissolve Stress & Tension.A
- %Program Files%\Brain Bullet!\Plugins\Superior Decision Making.A
- %Program Files%\Brain Bullet!\Plugins\Super Positivity.A
- %Program Files%\Brain Bullet!\Plugins\Breathe Relief From Allergies.A
- %Program Files%\Brain Bullet!\Plugins\The Virtue of Patience.A
- %Program Files%\Brain Bullet!\Plugins\Achieve Ultimate Success.A
- %Program Files%\Brain Bullet!\Plugins\Rocketing Your Self-Esteem.A
- %Program Files%\Brain Bullet!\Plugins\Speed Reading.A
- %Program Files%\Brain Bullet!\Plugins\Quit Smoking, For Good!.A
- %Program Files%\Brain Bullet!\Plugins\You're Funny, And They Know It!.A
- %Program Files%\Brain Bullet!\Plugins\You're a Natural Public Speaker.A
- %Program Files%\Brain Bullet!\Plugins\Free-flowing Creative Genius.A
- %Program Files%\Brain Bullet!\Plugins\Get What You Want, Now!.A
- %Program Files%\Brain Bullet!\Plugins\Improve Your Marriage.A
- %Program Files%\Brain Bullet!\Plugins\Love Yourself, Love Your Life.A
- %Program Files%\Brain Bullet!\Plugins\Attract Your Ideal Partner.A
- %Program Files%\Brain Bullet!\Plugins\Rapid Calm.A
- %Program Files%\Brain Bullet!\Plugins\Super Self-Confidence.A
- %Program Files%\Brain Bullet!\Plugins\Surging Muscle Growth!.A
- %Program Files%\Brain Bullet!\Plugins\Free From The Past.A
- %Program Files%\Brain Bullet!\Plugins\Get Motivated!.A
- %Start Menu%\Programs\Brain Bullet!\Uninstall Brain Bullet!.lnk
- %Start Menu%\Programs\Brain Bullet!\Brain Bullet!.lnk
- %Desktop%\Brain Bullet!.lnk
- %Program Files%\BRAINB~1\bb.ini
Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
Step 6
Search and delete these folders
- %Program Files%\Brain Bullet!
- %Program Files%\Brain Bullet!\Icons
- %Program Files%\Brain Bullet!\Music
- %Program Files%\Brain Bullet!\Plugins
- %Start Menu%\Programs\Brain Bullet!
Step 7
Restart in normal mode and scan your computer with your Trend Micro product for files detected as TROJ_ZEROML.QR. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Step 8
Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.
- %Program Files%\Brain Bullet!\Uninstall.exe
- %Program Files%\Brain Bullet!\bb.ini
- %Program Files%\Brain Bullet!\bb.chm
- %Program Files%\Brain Bullet!\Version History.txt
- %Program Files%\Brain Bullet!\Readme.txt
- %Program Files%\Brain Bullet!\Icons\16.ico
- %Program Files%\Brain Bullet!\Icons\32.ico
- %Program Files%\Brain Bullet!\Icons\48.ico
- %Program Files%\Brain Bullet!\Icons\Thumbs.db
- %Program Files%\Brain Bullet!\Music\Jesus Joy of Man.mid
- %Program Files%\Brain Bullet!\Music\Minuet 1.mid
- %Program Files%\Brain Bullet!\Music\Minuet 2.mid
- %Program Files%\Brain Bullet!\Music\Minuet 3.mid
- %Program Files%\Brain Bullet!\Music\Musette.mid
- %Program Files%\Brain Bullet!\Music\Rameau.mid
- %Program Files%\Brain Bullet!\Music\Telemann.mid
- %Program Files%\Brain Bullet!\Music\BJSF 1.mid
- %Program Files%\Brain Bullet!\Music\BJSF 5.mid
- %Program Files%\Brain Bullet!\Music\Couper 1.mid
- %Program Files%\Brain Bullet!\Music\Couper 2.mid
- %Program Files%\Brain Bullet!\Plugins\Accepting Criticism, Listening To Others.txt
- %Program Files%\Brain Bullet!\Plugins\Instant Memory Bank!.txt
- %Program Files%\Brain Bullet!\Plugins\Control Your Dreams At Night.txt
- %Program Files%\Brain Bullet!\Plugins\I Love Today.txt
- %Program Files%\Brain Bullet!\Plugins\Being a Great Parent.txt
- %Program Files%\Brain Bullet!\Plugins\Ultimate Leadership Skills.txt
- %Program Files%\Brain Bullet!\Plugins\The Supreme Athlete.txt
- %Program Files%\Brain Bullet!\Plugins\Pass Your Exams!.txt
- %Program Files%\Brain Bullet!\Plugins\Dissolve Stress & Tension.txt
- %Program Files%\Brain Bullet!\Plugins\Superior Decision Making.txt
- %Program Files%\Brain Bullet!\Plugins\Super Positivity.txt
- %Program Files%\Brain Bullet!\Plugins\Breathe Relief From Allergies.txt
- %Program Files%\Brain Bullet!\Plugins\The Virtue of Patience.txt
- %Program Files%\Brain Bullet!\Plugins\Achieve Ultimate Success.txt
- %Program Files%\Brain Bullet!\Plugins\Rocketing Your Self-Esteem.txt
- %Program Files%\Brain Bullet!\Plugins\Speed Reading.txt
- %Program Files%\Brain Bullet!\Plugins\Quit Smoking, For Good!.txt
- %Program Files%\Brain Bullet!\Plugins\You're Funny, And They Know It!.txt
- %Program Files%\Brain Bullet!\Plugins\You're a Natural Public Speaker.txt
- %Program Files%\Brain Bullet!\Plugins\Free-flowing Creative Genius.txt
- %Program Files%\Brain Bullet!\Plugins\Get What You Want, Now!.txt
- %Program Files%\Brain Bullet!\Plugins\Improve Your Marriage.txt
- %Program Files%\Brain Bullet!\Plugins\Love Yourself, Love Your Life.txt
- %Program Files%\Brain Bullet!\Plugins\Attract Your Ideal Partner.txt
- %Program Files%\Brain Bullet!\Plugins\Rapid Calm.txt
- %Program Files%\Brain Bullet!\Plugins\Super Self-Confidence.txt
- %Program Files%\Brain Bullet!\Plugins\Surging Muscle Growth!.txt
- %Program Files%\Brain Bullet!\Plugins\Free From The Past.txt
- %Program Files%\Brain Bullet!\Plugins\Get Motivated!.txt
- %Program Files%\Brain Bullet!\bb.exe
Did this description help? Tell us how we did.