B3D Killer - remove BDE/B3D scumware...

[javacool]

(The following was created following the March 1st report of the hidden/trojan features of a program known as "B3D Projector". Unfortunately, as the default uninstaller only remove the "projector" part (and not the more sinister part) I decided to take the issue into my own hands...)



I had a little time on my hands, so I whipped up a little program to get rid of BDE/B3D - i.e. all of the Brilliant Digital "scumware".

Not only will it purge your pc of the executables and dlls, but it will get rid of the registry entries.

Link to download: http://javacool1.freeservers.com/ UPDATE: I can't seem to link directly to the file, so I've built a short index.html page - it will let you download from there.

Although the code may not be the most well-written * it gets the job done - given more time I could obviously improve it. (It is also written in VB 6, as that is what I had immediately on hand, and allowed me to make the program do what I wanted it to do in a very short time.)


Any comments/suggestions/etc. would be very welcome. In fact, for anyone who has the Brilliant Digital software installed on their system - it would be GREAT if you could test the program out and give any success/failure/etc. reports. It works fine on my systems, but you never know.

Also, I'd be happy to keep the program updated with the latest removals, as I'm sure Brilliant Digital will be releasing some sort of update soon to embed their software even deeper into the system. *:-/


Features of B3D Killer v1.0.2:
-Removes all traces of the Brilliant Digital software (dlls and executables) from your computer.
-Deletes most, if not all, registry keys associated with the program and its "auto-install" function (which lets it re-install itself silently when you browse a webpage).
-Displays output of all actions performed.
-Is only 40 kb.

Files are moved to the recycle bin - and can be deleted completely after reboot (I decided to make it this way to ensure that IF any problems would arise, you could revert those changes).

If you are a little cautious with what it does to your registry (which should be perfectly safe - it ONLY remove B3D entries and was tested on many systems) you can always create a registry backup before you use the program.


Also, if anyone is willing to place this file on their sites/servers (if you like it enough ) I'd be very happy (as currently it's on a free web-hosting service, and they have a limit of bandwidth per month).

Download here (I don't know how long this will stay up, with the bandwidth limit...): http://javacool1.freeservers.com UPDATE: I can't seem to link directly to the file, so I've built a short index.html page - it will let you download from there.

Enjoy! *

[Blacksheep]

Will it remove Brilliant from Kazaa?

http://www.zdnet.com.au/newstech/communications/story/0,2000024993,20264356,00.htm

[javacool]

Will it remove Brilliant from Kazaa?

http://www.zdnet.com.au/newstech/communications/story/0,2000024993,20264356,00.htm

I'm sorry, I should have specified...

YES it will remove Brilliant from Kazaa and/or ANY other program that installs it.

[javacool]

Found some scary information (from a news.com interview):

The most controversial point so far has been how Altnet is being built, and how the software is being distributed. Describe your thinking there and how that will work.
Brilliant has been downloading certain components in the past for its advertising technologies. One or two of those components are functional components that can be used for Altnet. But the primary components, which are required to bring Altnet into existence, have not yet been distributed.

At the point those components are distributed, end users will be aware, in the interest of full disclosure, that those components are being distributed. More importantly, when those components are utilized on the end users' desktop to share resources to utilize the resources of their PC--either though file sharing or bandwidth sharing or distributed processing or distributed storage--the user will be notified of our intention to use those resources, and the user will opt in to the program.

If they don't let you fully uninstall the "new" parts they will "helpfully" be downloading to your computer without your knowledge - I can see that I might have to update the program very soon (once the new "update" comes out)...

Right now, however, the B3D Killer program will remove all the parts of the Brilliant Digital software - INCLUDING those that would "let" it automatically install the new "update" without your permission.

[eyespy]

* * *Javacool...your proggie is short and sweet !!
I ran it after I ran SpybotSD. Your proggie found 3 more reg. entries under the *"B3D string", * that SpybotSD missed !

* * * * * * * * * * * kudos my man!!
* * * * * * * * * * * * * * * * * * * * * * * *bill * * *

[Blacksheep]

I don't trust those bast**ds - they'll probably install and then maybe ask for permission.

1] Will your prog run without WSH installed?

2] Will Kazaa still work with Brilliant removed?

[javacool]

I don't trust those bast**ds - they'll probably install and then maybe ask for permission.

1] Will your prog run without WSH installed?

2] Will Kazaa still work with Brilliant removed?

The program will work as long are your computer has the Visual Basic 6 run-time files (which is almost 100% of the time the case, if not, they are a quick download on MS's site - Win XP comes with them built in, for sure, and so do Windows 98 and ME, I believe.)

Kazaa WILL still work with Brilliant removed. In fact, an article I was reading someplace else (will have to try and find it) said that once that person removed Brilliant, Kazaa stopped pinging some weird IP address...

It's a quick fix for the problem - and everyone should be able to run it just fine without having to install any additional software. *

[javacool]

* * *Javacool...your proggie is short and sweet !!
I ran it after I ran SpybotSD. Your proggie found 3 more reg. entries under the *"B3D string", * that SpybotSD missed !

* * * * * * * * * * * kudos my man!!
* * * * * * * * * * * * * * * * * * * * * * * *bill * * *

I'm still picking through the registry bit by bit for more Brilliant Digital entries - they're all over the place, and hidden in many ways. Even if there are some more that my program doesn't locate, it removes all the files, ensuring that they shouldn't have any affect. *

Glad the program helped you out.

[Blacksheep]

Kudos javacool!

I was hoping someone would develop an exterminator for this Brilliant trojan scumware beast. This crap takes advantage of the ignorant - many kids don't bother reading EULAS.

[luv2bsecure]

Way to go, Javacool. VERY nice job!

John

[Blacksheep]

Hmm... can't download?

Forbidden

Remote Host: [xx.xxx.xx.xxx]

You do not have permission to access http://javacool1.freeservers.com/b3dkiller.exe

Data files must be stored on the same site they are linked from.

Thank you for using FreeServers

[Blacksheep]

Never mind - enabling referrer logging fixed it.

[Paul Wilders]

For those interested:

The file is available for download from this moment on from our downloads page (scroll to the bottom):

www.wilders.org/downloads.htm

regards.

paul

edit: something went wrong while putting the file up for download. Will *be corrected within 8 hours at max.

[Checkout]

Javacool,

Please accept two - no, three - higher notches on my Respect-O-Meter. *

Great job, Javacool !!! *

I don't have Kazaa or something like that on my machine, but I'm going to see whether it will nevertheless find something.

Thanks!

[javacool]

Just a note for everyone here: the program has been updated to version 1.1.

Download is still here: http://javacool1.freeservers.com

Size is now 48 kb.

New features:
-Added 29 new B3D/BDE registry keys to be deleted!

I would recommend that everyone who downloaded the original file re-download to get the newest one. It finishes the job the first one started. *

I was able to watch the processes of the B3D installation (original 1.0 version, all the way up to the newest version released just a couple days ago, I believe). The B3D Killer program now removes ALL traces of B3D\BDE from your system (from version 1.0 of B3D up to the newest version distributed on the web and through KaZaA 1.6, I have discovered).

Strangely enough, it seems as though the absolute newest version of B3D is ONLY "available" through KaZaA - although I'm sure that will change soon (the official brilliant digital website's installer installs less files).

[Blacksheep]

Maybe this will interest you:

http://news.com.com/2100-1023-875274.html

[javacool]

Maybe this will interest you:

http://news.com.com/2100-1023-875274.html

Already saw that, but thanks!

Unfortunately, the steps presented there do nothing for the registry entries - some of which allow the software to be re-install SILENTLY with no end-user knowledge when your browse a web page.

If it were truly that easy to get rid of the scumware, I wouldn't have made the program to deal with it. *

I will gladly post the full list of registry entries that the program deletes if anyone is interested - its rather long. * However, there are quite a few entries that I found myself, and have not seen anywhere else.

-javacool

[Blacksheep]

javacool your prog is great!

I would suggest you post more prog info, and contact info on your download page?

When this hits the Net big time you may be getting a lot of traffic.

[javacool]

When this hits the Net big time you may be getting a lot of traffic.

Exactly the problem - I haven't even sent information about it to sites such as slashdot since there IS a chance of it getting posted and the infamous "Slashdot effect" would not only render the page unviewable, but would exceed the monthly bandwidth limit on the free web hosting service in a matter of SECONDS. *:-/

[Blacksheep]

Hmm... dilemma! There must be a way around the bandwidth problem. Mirrors?

I think your prog should be made available to many!

[javacool]

Hmm... dilemma! There must be a way around the bandwidth problem. Mirrors?

I think your prog should be made available to many!

Thanks again for the complements. *

And yes, mirrors would DEFINITELY be of some help. Hopefully, the small issue that prevented the download of it from wilders.org should be fixed soon, and that's at least one high-quality mirror.

The program itself is very small, so if you manage to talk to anyone who has free webspace/bandwidth PLEASE *don't hesitate to have them contact me! * (They can contact me through the PM functions on these forums, most easily.)

[Mr.Blaze]

=(i get error not a valid win 32 aplication error when i try to run it

i get that forbidden page. *how do i get it not to do that?

[Blacksheep]

i get that forbidden page. *how do i get it not to do that?

Enable referrer logging and pop-ups.