Fwb Dloader 1.0 Beta

· Overview ·
· Origins ·
· Operation ·
· Detection and Removal ·
· Research ·

Overview

Vendor Notes:

 from the doc:
Fwb Dloader Beta uses a different method for bypassing firewalls than most fwb downwloaders Most inject a dll into a process. Well thats kinda hard in vb so i had to improvise How it works. It is attaches to internet explorer as an activex control. Everytime IE and/or explorer.exe is loaded the activex gets loaded aswell, tricking the firewall into thinking IE is downloading the file. So if the file it downloads is missing it will re-download the file everytime IE or explorer.exe is loaded, disabling the need for a startup method :P Its still beta but i hope to add it in CIA, watch this it will be memory resident once you execute it so test it with something harmless!!!
Alch3mizt

Alias:

 Trojan Horse.LC [Panda], TrojanDownloader.Win32.VB.w, TrojanDownloader.Win32.VB.w [Kaspersky]

Category:

Downloader: A program designed to retrieve and install additional files, when run. Most will be configured to retrieve from a designated web or FTP site.

Trojan: Any program with a hidden intent. Trojans are one of the leading causes of breaking into machines. If you pull down a program from a chat room, new group, or even from unsolicited e-mail, then the program is likely trojaned with some subversive purpose. The word Trojan can be used as a verb: To trojan a program is to add subversive functionality to an existing program. For example, a trojaned login program might be programmed to accept a certain password for any user's account that the hacker can use to log back into the system at any time. Rootkits often contain a suite of such trojaned programs.

Similar Pests:

 Downloader · Trojan

Origins

Author:

 Alch3mizt

URL:

 http://c-i-a.2ya.com

Programming Language:

 Visual Basic

Date of Origin:

 September, 2003

Operation

Storage Required:
  • Fwb Dloader 1.0 Beta: at least 65 KB
    		•

    Restart:

    		 See "Vendor Description"
    Autostarting Pests

    ScreenShot:


    Fwb Dloader 1.0 Beta


    Fwb Dloader 1.0 Beta

    Detection and Removal

    Automatic Removal:

    PestPatrol detects this.

    PestPatrol removes this.

    Manual Removal:

    		 Follow these steps to remove Fwb Dloader 1.0 Beta from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.
    Stop Running Processes:

    Kill these running processes with Task Manager:

    Unregister DLLs:

    Unregister these DLLs with Regsvr32, then reboot:

    Remove Files:

    Remove these files (if present) with Windows Explorer:

    Research

    File Analyses:

    More Info:
  • AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
    		•

    Research By:
  • PestPatrol's Pest Research Center
    		•

    Last Revised:

    		 April 03, 2005