Stop Sign trojan ?? download.wren.a

[mikeyB]

I am testing a application at the moment for www.newbie.org called stop sign to see if it has a malicious trojan in it. On instal when a free AVG application was active, it detected a trojan called DOWNLOAD.WREN.A I have been unable to find this trojan anywhere on the web! - for testing purposes I had to uninstall the AVG free app and then instal the stop sign application, all went through fine.

I have now installed the trial copy of TDS-3 to see if it could find a trojan on the supposidly infected PC, but was unsuccessfull?? is this really a trojan or did the anti virus application identify a bogus trojan or is it a spoofed name???

Any help would be usefull.

Many Thanks

MikeyB

[Pieter_Arntz]

Hi mikeyB,

Warnings on Stop-Sign:
http://www.doxdesk.com/parasite/DownloadReceiver.html
http://www.safersite.com/PestInfo/S/StopSign.asp

Regards,

Pieter

[Pilli]

Hi MikeyB & welcome :)
In TDS3 you need to enter the Scan control and tick all the various Scans, then run a full scan, BTW this will take some time on large hard disks.
When searching for this file manually please ensure that you have "Show hidden" enabled in your file manager (desktop explorer) If you find the file then please zip it up & submit it to:
submit@diamondcs.com.au for analysis:

Thanks. Pilli

[mikeyB]

thanks for the quick responces guys..really appreciate it, pilli - i did go into the TDS scan control and enabled everything on the 1st scan after downloading it, I was warned that the radian (i think they were called) were out of date.. i then went tot the site listed and downloaded them and replaced the file that was on my machine! another scan..still nothing ?! I was under the impression that TDS would find almost any trojan, I hope so :)

also thats peitre, I have read the URL on pest patrol, will scan with it tonight when i get home and see what smokes!

Thanks

MikeyB

[Pilli]

Best of luck with your search mikeyB, it may not be a Trojan but some other malware such as a dialer.
If you still have doubts go to the hijack this forum here at Wilders and follow the instruction for HJt, post your results and the experts there will be able to give an opinion for you. :)

[mikeyB]

Just a quick question, before I look at purchasing TDS-3 is there a easy method or auto remover of trojans in this package - if it detects them? Or even better a URL or document you can point me to to tell me how to do it?

Or is it just a detection utility and not a cleaner?

Sorry to hassle you..

MikeyB

[Pilli]

No problem mikeyb, When malware if found by TDS you get the option to delete - submit it etc.

You will find much more information in the TDS help file :)

Don't fproget to look at the special purchase offers on the DCS website and also the very useful free tools.

www.diamondcs.com.au

[Jasmin]

Hello all,

I downloaded a free anti virus software called Stop Sign, What a mistake that was!!

i see that MikeyB found a trojan called DOWNLOAD.WREN.A i too have this virus. Unfortunatly, i find complex removal difficult as i am partialy blind,

Please please please does anyone know of a automatic removal tool for this nasty trojan?

Or will the nice people at TDS be looking into finding a clean-up for this trojan.

Many thanks

Jasmin

[Pieter_Arntz]

Hi jasmin,

As far as I know Spybot S&D removes StopSign.
So you can download Spybot - Search & Destroy (http://www.tomcoyote.org/SPYBOT/)
After installing, first press Online, and search for, put a check mark at, and install all updates.
Next, close all IE windows, hit 'Check for Problems', and have SpyBot remove all it marks in red.

Regards,

Pieter

[Jasmin]

Hi Pieter,

I already am well versed in anti spyware, i use spybot s&d, spyware blaster, adaware and spyhunter - as you can guess i don't like spyware :) , none of them can find this little trojan! I have posted and searched until my little fingers got sore! do you know if TDS are looking into targeting this monster?

Thanks

Jasmin

[puff-m-d]

Hi Jasmin,

Have you tried this:

There should be a 'Download Receiver' entry in the Control Panel's Add/Remove Programs option. After removing the software you should be able to delete download.exe, eac_drec.dll and systimer.exe from the eAcceleration folder in Program Files\Common Files. You can delete the folder itself if you have nothing else installed from eAcceleration (eg. eAnthology).

Taken from this website (http://www.doxdesk.com/parasite/DownloadReceiver.html) that Pieter posted above in reply # 1?

Regards,
Kent

[Pieter_Arntz]

Hi Jasmin,

I would not expect them too, since StopSign is generally considered adware: http://pestpatrol.com/PestInfo/S/StopSign.asp

Could you jump to Step 2 of this post:
http://www.wilderssecurity.com/showthread.php?t=15913
With any luck I should be able to help you get rid of it if you post your HijackThis log.

I think I will move this thread to that section later on, anyway.

Regards,

Pieter

[Jooske]

Please do exactly as Pieter says, each step. I jsut googled around and saw some forums where things went wrong (they had not Pieter or another known HJT specialist at hand it seems) and only because ther person had a good backup had not lost everything after a necessary reformat in that case.
Be sure Pieter does what ever is possible to save your system.
I was not aware yet that this parasite can be so nasty!
I must congratulate you though, that you found your way to this serious forum where you will only be advised the good stuff and programs which are seriously there for your protection etc and free where possible!

[Pilli]

Hi Jasmin, Good advice frome Pieter & Jooske.

TDS is mainly a Trojan killer although does cover some spyware such as keyloggers and other malware.

Unfortunately many sites can download commercial programmes which include spyware merely because you accept their Terms & conditions. So read them & any privacy statements before agreeing, particlarly difficult for someone in your position I know but they can do it - A case of user beware :(

HTH Pilli

[Neil]

Hi
I have a mate's computer here to try and sort out a virus called downloader.Wren.b
AVG picks it up every time, but I can not delete it or heal it.
It is giving me major problems.
If you come up with a solution, I would be very grtefull of any info.
Thanks
Neil

[Reaper-X]

-{ Quote: "Hi
I have a mate's computer here to try and sort out a virus called downloader.Wren.b
AVG picks it up every time, but I can not delete it or heal it.
It is giving me major problems.
If you come up with a solution, I would be very grtefull of any info.
Thanks
Neil" }-

Use 2 virus scanners... For example... AVG and mcaffe.... If you have a virus that AVG finds but cant pic up...write the directory down and quarantine it using mcaffe Then send to Avert and Delete.

[davidnason]

-{ Quote: "I am testing a application at the moment for www.newbie.org called stop sign to see if it has a malicious trojan in it. On instal when a free AVG application was active, it detected a trojan called DOWNLOAD.WREN.A I have been unable to find this trojan anywhere on the web! - for testing purposes I had to uninstall the AVG free app and then instal the stop sign application, all went through fine.

I have now installed the trial copy of TDS-3 to see if it could find a trojan on the supposidly infected PC, but was unsuccessfull?? is this really a trojan or did the anti virus application identify a bogus trojan or is it a spoofed name???

Any help would be usefull.

Many Thanks

MikeyB" }-

MikeyB,

DOWNLOAD.WREN.A was the name once given to the stub installer once used by eAcceleration in its StopSign antivirus product. Its actual filename was wren.exe. It was not a trojan or any other form of malware.

StopSign has been evaluated and reviewed by Microsoft, Norton, McAfee, AVG, PestPatrol and many others and has been determined to free of any spyware, adware, or other form of malware.

Cheers,
David Nason
CTO
eAcceleration Corp.

[Notok]

Amazing.. this thread hasn't been posted to since November of last year, but the CTO of Stop-Sign posts to it just hours after I was looking at it because of a system I was working on that was having problems with Stop-Sign :o

Honestly, they may have cleaned up their act, but trust doesn't return that easily for me. There are plenty of other (Free!) apps that will do the same thing but much better.