Trojan.Zoremov
![detection icon](https://www.malwarebytes.com/wp-content/themes/malwarebytes/assets/src/images/malware-detection.png)
Short bio
Trojan.Zoremov is Malwarebytes’ detection name for a Trojan.Dropper that targets Windows systems.
Symptoms
Users of an affected system may see an entry titled Zoremov in their list of installed Programs and Features.
Trojan.Zoremov gains persistence by adding a user Run key to the registry that starts the Trojan at boot.
Type and source of infection
Trojan.Zoremov usually arrives at the target systems as a self extracting cabinet file. Trojan.Droppers are capable of downloading and running additional malware on the affected system.
Protection
![block Trojan.Zoremov](https://www.malwarebytes.com/wp-content/uploads/sites/2/2020/04/trojanzoremovblock.png)
Malwarebytes blocks Trojan.Zoremov
Home remediation
Malwarebytes can detect and remove Trojan.Zoremov without further user interaction.
- Please download Malwarebytes to your desktop.
- Double-click MBSetup.exe and follow the prompts to install the program.
- When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
- Click on the Get started button.
- Click Scan to start a Threat Scan.
- Click Quarantine to remove the found threats.
- Reboot the system if prompted to complete the removal process.
Business remediation
How to remove Trojan.Zoremov with the Malwarebytes Nebula console
You can use the Malwarebytes Anti-Malware Nebula console to scan endpoints.
![endpoint menu](https://www.malwarebytes.com/wp-content/uploads/sites/2/2018/04/endpointmenu.png)
Nebula endpoint tasks menu
Choose the Scan + Quarantine option. Afterwards you can check the Detections page to see which threats were found.
![Nebula detections](https://www.malwarebytes.com/wp-content/uploads/sites/2/2017/08/Nebula_new.png)
On the Quarantine page you can see which threats were quarantined and restore them if necessary.
![Nebula Quarantaine](https://www.malwarebytes.com/wp-content/uploads/sites/2/2017/08/quarantine1.png)
Traces/IOCs
Files: %DESKTOP%\Filecoach.lnk %APPDATA%\AppRun\AppRun.exe
Registry: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|AppRun={path to}\AppRun.exe HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zoremov