B3D Killer - remove BDE/B3D scumware...

[javacool]

(The following was created following the March 1st report of the hidden/trojan features of a program known as "B3D Projector". Unfortunately, as the default uninstaller only remove the "projector" part (and not the more sinister part) I decided to take the issue into my own hands...)



I had a little time on my hands, so I whipped up a little program to get rid of BDE/B3D - i.e. all of the Brilliant Digital "scumware".

Not only will it purge your pc of the executables and dlls, but it will get rid of the registry entries.

Link to download: http://javacool1.freeservers.com/ UPDATE: I can't seem to link directly to the file, so I've built a short index.html page - it will let you download from there.

Although the code may not be the most well-written *;) it gets the job done - given more time I could obviously improve it. (It is also written in VB 6, as that is what I had immediately on hand, and allowed me to make the program do what I wanted it to do in a very short time.)


Any comments/suggestions/etc. would be very welcome. In fact, for anyone who has the Brilliant Digital software installed on their system - it would be GREAT if you could test the program out and give any success/failure/etc. reports. It works fine on my systems, but you never know.

Also, I'd be happy to keep the program updated with the latest removals, as I'm sure Brilliant Digital will be releasing some sort of update soon to embed their software even deeper into the system. *:-/


Features of B3D Killer v1.0.2:
-Removes all traces of the Brilliant Digital software (dlls and executables) from your computer.
-Deletes most, if not all, registry keys associated with the program and its "auto-install" function (which lets it re-install itself silently when you browse a webpage).
-Displays output of all actions performed.
-Is only 40 kb.

Files are moved to the recycle bin - and can be deleted completely after reboot (I decided to make it this way to ensure that IF any problems would arise, you could revert those changes).

If you are a little cautious with what it does to your registry (which should be perfectly safe - it ONLY remove B3D entries and was tested on many systems) you can always create a registry backup before you use the program.


Also, if anyone is willing to place this file on their sites/servers (if you like it enough :)) I'd be very happy (as currently it's on a free web-hosting service, and they have a limit of bandwidth per month).

Download here (I don't know how long this will stay up, with the bandwidth limit...): http://javacool1.freeservers.com UPDATE: I can't seem to link directly to the file, so I've built a short index.html page - it will let you download from there.

Enjoy! *;D

[Blacksheep]

Will it remove Brilliant from Kazaa?

http://www.zdnet.com.au/newstech/communications/story/0,2000024993,20264356,00.htm

[javacool]

{QUOTE-> Will it remove Brilliant from Kazaa?

http://www.zdnet.com.au/newstech/communications/story/0,2000024993,20264356,00.htm <-QUOTE}

I'm sorry, I should have specified...

YES it will remove Brilliant from Kazaa and/or ANY other program that installs it.

[javacool]

Found some scary information (from a news.com interview):
{QUOTE-> The most controversial point so far has been how Altnet is being built, and how the software is being distributed. Describe your thinking there and how that will work.
Brilliant has been downloading certain components in the past for its advertising technologies. One or two of those components are functional components that can be used for Altnet. But the primary components, which are required to bring Altnet into existence, have not yet been distributed.

At the point those components are distributed, end users will be aware, in the interest of full disclosure, that those components are being distributed. More importantly, when those components are utilized on the end users' desktop to share resources to utilize the resources of their PC--either though file sharing or bandwidth sharing or distributed processing or distributed storage--the user will be notified of our intention to use those resources, and the user will opt in to the program.
<-QUOTE}

If they don't let you fully uninstall the "new" parts they will "helpfully" be downloading to your computer without your knowledge - I can see that I might have to update the program very soon (once the new "update" comes out)...

Right now, however, the B3D Killer program will remove all the parts of the Brilliant Digital software - INCLUDING those that would "let" it automatically install the new "update" without your permission.

[eyespy]

* * *Javacool...your proggie is short and sweet !!
I ran it after I ran SpybotSD. Your proggie found 3 more reg. entries under the *"B3D string", * that SpybotSD missed !

* * * * * * * * * * * kudos my man!!
* * * * * * * * * * * * * * * * * * * * * * * *bill * * * ;)

[Blacksheep]

I don't trust those bast**ds - they'll probably install and then maybe ask for permission.

1] Will your prog run without WSH installed?

2] Will Kazaa still work with Brilliant removed?

[javacool]

{QUOTE-> I don't trust those bast**ds - they'll probably install and then maybe ask for permission.

1] Will your prog run without WSH installed?

2] Will Kazaa still work with Brilliant removed? <-QUOTE}

The program will work as long are your computer has the Visual Basic 6 run-time files (which is almost 100% of the time the case, if not, they are a quick download on MS's site - Win XP comes with them built in, for sure, and so do Windows 98 and ME, I believe.)

Kazaa WILL still work with Brilliant removed. In fact, an article I was reading someplace else (will have to try and find it) said that once that person removed Brilliant, Kazaa stopped pinging some weird IP address...

It's a quick fix for the problem - and everyone should be able to run it just fine without having to install any additional software. *:)

[javacool]

{QUOTE-> * * *Javacool...your proggie is short and sweet !!
I ran it after I ran SpybotSD. Your proggie found 3 more reg. entries under the *"B3D string", * that SpybotSD missed !

* * * * * * * * * * * kudos my man!!
* * * * * * * * * * * * * * * * * * * * * * * *bill * * * ;) <-QUOTE}

I'm still picking through the registry bit by bit for more Brilliant Digital entries - they're all over the place, and hidden in many ways. Even if there are some more that my program doesn't locate, it removes all the files, ensuring that they shouldn't have any affect. *:)

Glad the program helped you out.

[Blacksheep]

Kudos javacool! ;D

I was hoping someone would develop an exterminator for this Brilliant trojan scumware beast. This crap takes advantage of the ignorant - many kids don't bother reading EULAS.

[luv2bsecure]

Way to go, Javacool. VERY nice job!

John

[Blacksheep]

Hmm... can't download?

Forbidden

Remote Host: [xx.xxx.xx.xxx]

You do not have permission to access http://javacool1.freeservers.com/b3dkiller.exe

Data files must be stored on the same site they are linked from.

Thank you for using FreeServers

[Blacksheep]

Never mind - enabling referrer logging fixed it. ::)

[Paul Wilders]

For those interested:

The file is available for download from this moment on from our downloads page (scroll to the bottom):

www.wilders.org/downloads.htm

regards.

paul

edit: something went wrong while putting the file up for download. Will *be corrected within 8 hours at max.

[Checkout]

Javacool,

Please accept two - no, three - higher notches on my Respect-O-Meter. *:)

[FanJ]

Great job, Javacool !!! *:)

I don't have Kazaa or something like that on my machine, but I'm going to see whether it will nevertheless find something.

Thanks!

[javacool]

Just a note for everyone here: the program has been updated to version 1.1.

Download is still here: http://javacool1.freeservers.com

Size is now 48 kb.

New features:
-Added 29 new B3D/BDE registry keys to be deleted!

I would recommend that everyone who downloaded the original file re-download to get the newest one. It finishes the job the first one started. *:)

I was able to watch the processes of the B3D installation (original 1.0 version, all the way up to the newest version released just a couple days ago, I believe). The B3D Killer program now removes ALL traces of B3D\BDE from your system (from version 1.0 of B3D up to the newest version distributed on the web and through KaZaA 1.6, I have discovered).

Strangely enough, it seems as though the absolute newest version of B3D is ONLY "available" through KaZaA - although I'm sure that will change soon (the official brilliant digital website's installer installs less files).

[Blacksheep]

Maybe this will interest you:

http://news.com.com/2100-1023-875274.html

[javacool]

{QUOTE-> Maybe this will interest you:

http://news.com.com/2100-1023-875274.html
<-QUOTE}

;D Already saw that, but thanks!

Unfortunately, the steps presented there do nothing for the registry entries - some of which allow the software to be re-install SILENTLY with no end-user knowledge when your browse a web page.

If it were truly that easy to get rid of the scumware, I wouldn't have made the program to deal with it. *;)

I will gladly post the full list of registry entries that the program deletes if anyone is interested - its rather long. *:) However, there are quite a few entries that I found myself, and have not seen anywhere else.

-javacool

[Blacksheep]

javacool your prog is great! ;D

I would suggest you post more prog info, and contact info on your download page?

When this hits the Net big time you may be getting a lot of traffic.:)

[javacool]

{QUOTE->
When this hits the Net big time you may be getting a lot of traffic.:) <-QUOTE}

Exactly the problem - I haven't even sent information about it to sites such as slashdot since there IS a chance of it getting posted and the infamous "Slashdot effect" would not only render the page unviewable, but would exceed the monthly bandwidth limit on the free web hosting service in a matter of SECONDS. *:-/

[Blacksheep]

Hmm... dilemma! ??? There must be a way around the bandwidth problem. Mirrors?

I think your prog should be made available to many! ;D

[javacool]

{QUOTE-> Hmm... dilemma! ??? There must be a way around the bandwidth problem. Mirrors?

I think your prog should be made available to many! ;D <-QUOTE}

Thanks again for the complements. *:)

And yes, mirrors would DEFINITELY be of some help. Hopefully, the small issue that prevented the download of it from wilders.org should be fixed soon, and that's at least one high-quality mirror.

The program itself is very small, so if you manage to talk to anyone who has free webspace/bandwidth PLEASE *don't hesitate to have them contact me! *:) (They can contact me through the PM functions on these forums, most easily.)

[Mr.Blaze]

=(i get error not a valid win 32 aplication error when i try to run it

[slawsk]

i get that forbidden page. *how do i get it not to do that? :-[

[Blacksheep]

{QUOTE-> i get that forbidden page. *how do i get it not to do that? :-[ <-QUOTE}
Enable referrer logging and pop-ups.

[Tester]

{QUOTE-> =(i get error not a valid win 32 aplication error when i try to run it <-QUOTE}

I think you need the Visual Basic run-time. Search http://www.micrososft.com for the VB 6 SP5 run-time installer.

[Tester]

Oops - misspelled that above link.

But here's the direct link: http://www.microsoft.com/downloads/release.asp?ReleaseID=28337&LangID=20&LangDIR=en-us&OpSysID=9801&Search=Keywords&Value=Visual+Basic&Show=Alpha&Start=&Page=0

[Rxdoxx]

Thank you!!!!!
Ran the program, KaZaa still works.

Did a search and found a number of files remaining, mostly .gag files Deleted them also.

I have my system backed up on a second HD. *Didn't see it clean the registry that was still there. Copied it to the D drive and tried running it from there also, so looks like your great program hits the active registry.

Final thing I am looking for is a list of files. I'm hesitant to delete everything with BDE in it. Still finding msxbde40.dll , mspbde40.dll , KBDE.KBD , and NETCBDEC.INF .
NETCBDEC.INF was a hidden file. I unhid and went looking just in case they had tried to sneak something in that way.

(Javacool, if you remember me, you'll remember I tend to go overboard with these things), still some questions in my mind, but I am very happy and grateful for the program. Thank you again.

[javacool]

{QUOTE-> Thank you!!!!!
Ran the program, KaZaa still works.

Did a search and found a number of files remaining, mostly .gag files Deleted them also. <-QUOTE}

Glad the program worked well for you.

{QUOTE-> I have my system backed up on a second HD. *Didn't see it clean the registry that was still there. Copied it to the D drive and tried running it from there also, so looks like your great program hits the active registry. <-QUOTE}

That is correct, the program only affects the active registry.

{QUOTE-> Final thing I am looking for is a list of files. I'm hesitant to delete everything with BDE in it. Still finding msxbde40.dll , mspbde40.dll , KBDE.KBD , and NETCBDEC.INF .
NETCBDEC.INF was a hidden file. I unhid and went looking just in case they had tried to sneak something in that way. <-QUOTE}

You shouldn't have to delete any other files if you ran my program - it gets rid of all the Brilliant Digital files installed - including those installed with the newest KaZaA (which has a newer version of Brilliant Digital).

WARNING: I generally wouldn't go around deleting everything with BDE in it - many are IMPORTANT system files. If you ran my program, you should be fine.
(This also applies to registry entries - there are many that include the string "BDE" that are important for windows, and then there are some that don't contain the string that are Brilliant Digital entries - my program should get rid of ALL the Brilliant registry entries too, so you won't have to manually search for any more.)

Note: if you really do want to check those files out to make sure they are legit, you can right click on the file, and select properties - that should tell you what company/software that file is from.

{QUOTE-> (Javacool, if you remember me, you'll remember I tend to go overboard with these things), still some questions in my mind, but I am very happy and grateful for the program. Thank you again. <-QUOTE}

I don't forget that easily. *;)

No problem with answering the questions, and you're quite welcome for the program.

If you have any other questions, don't hesitate to ask. *:)

[spy1]

javacool - I'd like to thank you for the program, too (yes, I came up clean everywhere).

You, Robin Keir ( http://keir.net/bde.html ) and AdAware are all to be highly commended for leaping all over that thing and beating it to death - for free! Pete

[GhostWerm]

Nice work javacool. Ive made a post on elitehackers.com: http://www.elitehackerz.com/ubb/ultimatebb.php?ubb=get_topic;f=8;t=000681 and mirrored your download as well as given a link to your download page. Keep finding those files and keys and updating the program...very cool indeed!

[Mr.Blaze]

bandwith problem
set up mass acounts at tripod with difrent e-maill adress

copy page at free servers upload to several tripods.


just paste the several urls of mirrors from tripods to free servers

but keep the tripods non asochiated wite freeservers

keep handy all your tripod acounts and pass words

never log in with rember me from now on.

mask ip

and always use internet sweeper to wipe out cookies ect after each visit to tripod and on to the next one.

im just guessing this is how its done=)

hey its for a good cause security =)why every one looking at me funny=)

[snowman]

* * * Javacool


* * * I am extending "thank you" from eight familes.

* * * today using your great lil program I cleaned their computers of <brilliant>.......the program worked wonderfully.........several of these computers were win95.......

* * *hip hip hooray....job well done....get-em Javacool!!

[GhostWerm]

If you need more mirros just let me know. I know how much of a pain it is to try to host files on a free servers. If you would like to use my link as a direct download mirror go ahead: *http://www.barrnun.com/bdkiller.exe

If you need anything else: domain name, webspace, mirrors, etc.. just send me an email and I will see what I can do to hook you up. Again, good job *8)

[Jooske]

Not sure which version i ran, as downloading 1.1.2 where it said "the newest version" it asked for username/password, so guess i had the 1.1 from ??
Coming up so clean, that i wondered if the program was even working :D. A little message would be helpfull i guess.
Never used Kazaa, could have been in another software... so good to be clean! *

[weh]

Nice work!

Perhaps you can answer a couple of questions...
In your study of this software were you able to determine how Brilliant software downloads and updates? Specifically, is the update function provided by KaZaa, or once Brilliant's software is present on a system does it function and update on its own? *(Does KaZaa have to be running for Brilliant to do its stuff?)

I am particularly interested in what you know about the ability of the software to re-infect a PC.

On an infected machine I was not able to detect any additional processes running in the task list - *so if KaZaa is not running can Brilliant still manipulate the machine?

[spy1]

Anyone who has been affected by 'Brilliant' should also check for (and delete if there) C:\WINDOWS\SYSTEM\bde3d_refk7.dll (or at the very least, un-register it). Pete

[javacool]

{QUOTE-> Nice work!

Perhaps you can answer a couple of questions...
In your study of this software were you able to determine how Brilliant software downloads and updates? Specifically, is the update function provided by KaZaa, or once Brilliant's software is present on a system does it function and update on its own? *(Does KaZaa have to be running for Brilliant to do its stuff?)

I am particularly interested in what you know about the ability of the software to re-infect a PC.

On an infected machine I was not able to detect any additional processes running in the task list - *so if KaZaa is not running can Brilliant still manipulate the machine?

<-QUOTE}

Actually, I do have a couple answers for those questions.

1) As far as I can tell, the updating only goes through the Zupdate program. It seems as though this program must run itself BEFORE most other things load (pretty suspicious) - which I believe is an attempt to circumvent outbound protecting software.

2) Kazaa does NOT have to be running for the Brilliant Digital software to function. Side note: Reports have indicated that the Kazaa software pings a strange outside IP address, and that this pinging stops once Brilliant is uninstalled...

3) As for your other question - the only components known as of yet are the B3D player and associated download components. The download components are, of course, the most dangerous, as they will allow the download of the "distributed computing" application part at a later date. As of now, no reports have come in of this new part being pushed out or activated, but supposedly, it soon will.

Hope this was somewhat useful to you, and I will post more later if I get a chance.

[Brian Martinez]

Hey as for bandw I have a few dedicated servers on my hands I can mir the file for you.

It can be on
www.visualdysfunction.com
www.obtainroot.com
www.gladewater.net
www.fekt.org
www.fektnetworks.com
etc..

and yes it is great thank you for helping us all with that great program :)

[spy1]

Javacool - I notice from this posting that the latest AA reflist update concerns a new version of Brilliant.

http://www.lavasoft.de/cgi-bin/forums/ikonboard.cgi?s=3cb97510778effff;act=ST;f=20;t=16

Are you going to update your program, too? Pete

[Mike_Healan]

It looks like BDE is planning to update it's crap every week now. I believe Urizen intends to match them with a new reflist each time.

[javacool]

{QUOTE-> Javacool - I notice from this posting that the latest AA reflist update concerns a new version of Brilliant.

http://www.lavasoft.de/cgi-bin/forums/ikonboard.cgi?s=3cb97510778effff;act=ST;f=20;t=16

Are you going to update your program, too? Pete <-QUOTE}

As soon as I obtain more information on this new version (and to make sure its not a version my program already covers) I will update B3D Killer's detection database. I have not yet found a new version of BDE online, however - but I will download the BDE Player from Brilliant Digital's website again today, and the same with Kazaa, to make sure it doesn't install anything new. (If I can confirm it does, you can be sure an update will be put out.) *:)

[javacool]

{QUOTE-> It looks like BDE is planning to update it's crap every week now. I believe Urizen intends to match them with a new reflist each time. <-QUOTE}

As I will, as soon as I can get my hands on the newest version of their "scum"...

[Paul Wilders]

Nice going, javacool!


{QUOTE-> As I will, as soon as I can get my hands on the newest version of their "scum"... <-QUOTE}

Seems like you will have to update on a weekly basis as well...

regards.

paul

[javacool]

{QUOTE-> Nice going, javacool!




Seems like you will have to update on a weekly basis as well...

regards.

paul <-QUOTE}

That seems to be the case.

In my investigation, which I just completed, I have found traces of a new version of BDE in the KaZaA 1.6 download (which, although the version number of KaZaA has not changed, installs different and/or more files/folders/registry keys).

A B3D Killer update is on its way...

[javacool]

B3D Killer v1.6 is now out.

See http://www.security-pro.co.uk/yabb/YaBB.pl?board=privacysoftware;action=display;num=1018913387.

Or go directly to http://www.wilderssecurity.com/B3DKiller.html to get it.


Additions in v1.6:
-Added new files, folders, and registry entries installed with the latest version of BDE to the detection database.

[Checkout]

Just an aside - my ZA logs show an attack from a service called "KAZAA" this morning. *Coincidence?

[eltercerhombre]

{QUOTE->

That seems to be the case.

In my investigation, which I just completed, I have found traces of a new version of BDE in the KaZaA 1.6 download (which, although the version number of KaZaA has not changed, installs different and/or more files/folders/registry keys).

A B3D Killer update is on its way... <-QUOTE}

Hi! I have used bde-killer 1.1.2 on my PC and then installed kazaa lite a few days ago (I´m running Windows XP professional... maybe u want know it). Now i´ve found: in Wininit.ini "/system32/bdeinstal2" -it´s a link to a non existing file- and, in system32, this files from Brilliant: bde3d_ref2.dll, bdeinsta25.dll, bdeload.dll, BDESac10.dll and BDERastDx6_30002.dll. My lastest version of kazaa was 1.5.1. Hope this will be helpfull for you. Any question e-mail me el_tercer_hombre@hotmail.com. Sorry for my bad english. Bye.

[securetype]

Hi,

Didn't completely remove all traces. *The folder "C:\WINDOWS\BDE" and it's subdirectories "b3dlogo", "Cache", "movies", "mskin", & "Update" cannot be removed on this Win XP (NTFS) machine. *They are "access denied" and considered to be "critical system files".

Already tried to remove via "Add/Remove Programs" prior to B3D Killer. *Ad-Aware can't remove these directories, either. *Booting into safe mode doesn't work.

What do you think?

David

[javacool]

{QUOTE-> Hi,

Didn't completely remove all traces. *The folder "C:\WINDOWS\BDE" and it's subdirectories "b3dlogo", "Cache", "movies", "mskin", & "Update" cannot be removed on this Win XP (NTFS) machine. *They are "access denied" and considered to be "critical system files".

Already tried to remove via "Add/Remove Programs" prior to B3D Killer. *Ad-Aware can't remove these directories, either. *Booting into safe mode doesn't work.

What do you think?

David <-QUOTE}

This is VERY strange...

It could be a new version/variant of BDE - or just something weird with how it installed itself on your system.

I'll have to look into this - if more people are having this occurance, and I can replicate it...Brilliant Digital has DEFINITELY made its software a trojan (if it can't be removed by simple deletion or uninstall - you can delete even WINDOWS folders/files, so this could be VERY malicious behavior).

-javacool

[TonyKlein]

Incidentally,

I received exacly the same reports on a Dutch board I frequent:

After running B3D Killer the Windows\BDE folder remained, and couldn't even be removed in Safe Mode.

So this is no isolated incident.

Hope you find out how to counter this.

Cheers, *Tony

[Hevanbe]

Version 1.6 deletes ALL entries from the software, I have found no more traces on disk!

[Hevanbe]

Maybe more info is in place here:
First de-installed KAZA on my Windows XP prof., installed KAZAlite and ran the remove software. Found a c:\bde map after removal and was able to delete this map.

[TonyKlein]

{QUOTE-> Incidentally,

I received exacly the same reports on a Dutch board I frequent:

After running B3D Killer the Windows\BDE folder remained, and couldn't even be removed in Safe Mode.

So this is no isolated incident.

<-QUOTE}

Update:

It turned out to be a storm in a teacup:
Apparently the guy had logged in using the wrong account.

Once he logged in using his son's account the BDE folder let itself be removed without a prob.

Cheers, Tony

[javacool]

{QUOTE->

Update:

It turned out to be a storm in a teacup:
Apparently the guy had logged in using the wrong account.

Once he logged in using his son's account the BDE folder let itself be removed without a prob.

Cheers, Tony

<-QUOTE}

Thanks a lot for the update - makes sense (but really depends on how Windows is set up).

Glad it seems NOT to be the Brilliant Digital software itself causing the removal problems! *:)

-javacool

[sader antoine]

ntoine{QUOTE-> Found some scary information (from a news.com interview):

If they don't let you fully uninstall the "new" parts they will "helpfully" be downloading to your computer without your knowledge - I can see that I might have to update the program very soon (once the new "update" comes out)...

Right now, however, the B3D Killer program will remove all the parts of the Brilliant Digital software - INCLUDING those that would "let" it automatically install the new "update" without your permission. <-QUOTE}

[javacool]

Just an update on B3D/Altnet.

B3D Killer should still remove all traces of B3D from your computer EXCEPT a file used only by Kazaa for the Altnet network.

This file does NOT transfer any information about your computer out, nor does it do any transferring of data at all. It acts as an index file - when you search in Kazaa for "MP3" for example, if someone has bought that keyword, and they are in that index file, their result will appear near the top of the result list. As of now, this file poses no real threat.

The distributed application part of the network is not yet up. When it is, though, it will supposedly allow a full and painless uninstall if you should want to get rid of it (it would also supposedly ask you before it installs the components for the distributed part of Altnet).

Just a small update from some quick testing. (Please note, that if any information stated within is incorrect, do not hold me responsible - I just did a quick testing of the new version - nothing extensive).

-javacool

[lmontem]

Hi this link doesn't link to anything.