B3D Killer - remove BDE/B3D scumware...

Discussion in 'SpywareBlaster & Other Forum' started by javacool, Apr 4, 2002.

Thread Status:
Not open for further replies.
  1. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    (The following was created following the March 1st report of the hidden/trojan features of a program known as "B3D Projector". Unfortunately, as the default uninstaller only remove the "projector" part (and not the more sinister part) I decided to take the issue into my own hands...)



    I had a little time on my hands, so I whipped up a little program to get rid of BDE/B3D - i.e. all of the Brilliant Digital "scumware".

    Not only will it purge your pc of the executables and dlls, but it will get rid of the registry entries.

    Link to download: http://javacool1.freeservers.com/ UPDATE: I can't seem to link directly to the file, so I've built a short index.html page - it will let you download from there.

    Although the code may not be the most well-written  ;) it gets the job done - given more time I could obviously improve it. (It is also written in VB 6, as that is what I had immediately on hand, and allowed me to make the program do what I wanted it to do in a very short time.)


    Any comments/suggestions/etc. would be very welcome. In fact, for anyone who has the Brilliant Digital software installed on their system - it would be GREAT if you could test the program out and give any success/failure/etc. reports. It works fine on my systems, but you never know.

    Also, I'd be happy to keep the program updated with the latest removals, as I'm sure Brilliant Digital will be releasing some sort of update soon to embed their software even deeper into the system.  :-/


    Features of B3D Killer v1.0.2:
    -Removes all traces of the Brilliant Digital software (dlls and executables) from your computer.
    -Deletes most, if not all, registry keys associated with the program and its "auto-install" function (which lets it re-install itself silently when you browse a webpage).
    -Displays output of all actions performed.
    -Is only 40 kb.

    Files are moved to the recycle bin - and can be deleted completely after reboot (I decided to make it this way to ensure that IF any problems would arise, you could revert those changes).

    If you are a little cautious with what it does to your registry (which should be perfectly safe - it ONLY remove B3D entries and was tested on many systems) you can always create a registry backup before you use the program.


    Also, if anyone is willing to place this file on their sites/servers (if you like it enough :)) I'd be very happy (as currently it's on a free web-hosting service, and they have a limit of bandwidth per month).

    Download here (I don't know how long this will stay up, with the bandwidth limit...): http://javacool1.freeservers.com UPDATE: I can't seem to link directly to the file, so I've built a short index.html page - it will let you download from there.

    Enjoy!  :D
     
  2. Blacksheep

    Blacksheep Spyware Fighter

    Joined:
    Feb 9, 2002
    Posts:
    109
    Location:
    Missouri, USA
    Will it remove Brilliant from Kazaa?

    http://www.zdnet.com.au/newstech/communications/story/0,2000024993,20264356,00.htm
     
  3. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    I'm sorry, I should have specified...

    YES it will remove Brilliant from Kazaa and/or ANY other program that installs it.
     
  4. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    Found some scary information (from a news.com interview):
    If they don't let you fully uninstall the "new" parts they will "helpfully" be downloading to your computer without your knowledge - I can see that I might have to update the program very soon (once the new "update" comes out)...

    Right now, however, the B3D Killer program will remove all the parts of the Brilliant Digital software - INCLUDING those that would "let" it automatically install the new "update" without your permission.
     
  5. eyespy

    eyespy Registered Member

    Joined:
    Feb 20, 2002
    Posts:
    490
    Location:
    Oh Canada !!
         Javacool...your proggie is short and sweet !!
    I ran it after I ran SpybotSD. Your proggie found 3 more reg. entries under the  "B3D string",   that SpybotSD missed !

                          kudos my man!!
                                                   bill       ;)
     
  6. Blacksheep

    Blacksheep Spyware Fighter

    Joined:
    Feb 9, 2002
    Posts:
    109
    Location:
    Missouri, USA
    I don't trust those bast**ds - they'll probably install and then maybe ask for permission.

    1] Will your prog run without WSH installed?

    2] Will Kazaa still work with Brilliant removed?
     
  7. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    The program will work as long are your computer has the Visual Basic 6 run-time files (which is almost 100% of the time the case, if not, they are a quick download on MS's site - Win XP comes with them built in, for sure, and so do Windows 98 and ME, I believe.)

    Kazaa WILL still work with Brilliant removed. In fact, an article I was reading someplace else (will have to try and find it) said that once that person removed Brilliant, Kazaa stopped pinging some weird IP address...

    It's a quick fix for the problem - and everyone should be able to run it just fine without having to install any additional software.  :)
     
  8. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    I'm still picking through the registry bit by bit for more Brilliant Digital entries - they're all over the place, and hidden in many ways. Even if there are some more that my program doesn't locate, it removes all the files, ensuring that they shouldn't have any affect.  :)

    Glad the program helped you out.
     
  9. Blacksheep

    Blacksheep Spyware Fighter

    Joined:
    Feb 9, 2002
    Posts:
    109
    Location:
    Missouri, USA
    Kudos javacool! :D

    I was hoping someone would develop an exterminator for this Brilliant trojan scumware beast. This crap takes advantage of the ignorant - many kids don't bother reading EULAS.
     
  10. luv2bsecure

    luv2bsecure Infrequent Poster

    Joined:
    Feb 9, 2002
    Posts:
    713
    Way to go, Javacool. VERY nice job!

    John
     
  11. Blacksheep

    Blacksheep Spyware Fighter

    Joined:
    Feb 9, 2002
    Posts:
    109
    Location:
    Missouri, USA
    Hmm... can't download?

    Forbidden

    Remote Host: [xx.xxx.xx.xxx]

    You do not have permission to access http://javacool1.freeservers.com/b3dkiller.exe

    Data files must be stored on the same site they are linked from.

    Thank you for using FreeServers
     
  12. Blacksheep

    Blacksheep Spyware Fighter

    Joined:
    Feb 9, 2002
    Posts:
    109
    Location:
    Missouri, USA
    Never mind - enabling referrer logging fixed it. :rolleyes:
     
  13. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,472
    Location:
    The Netherlands
    For those interested:

    The file is available for download from this moment on from our downloads page (scroll to the bottom):

    www.wilders.org/downloads.htm

    regards.

    paul

    edit: something went wrong while putting the file up for download. Will  be corrected within 8 hours at max.
     
  14. Checkout

    Checkout Security Rhinoceros

    Joined:
    Feb 11, 2002
    Posts:
    1,226
    Javacool,

    Please accept two - no, three - higher notches on my Respect-O-Meter.  :)
     
  15. FanJ

    FanJ Guest

    Great job, Javacool !!!  :)

    I don't have Kazaa or something like that on my machine, but I'm going to see whether it will nevertheless find something.

    Thanks!
     
  16. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    Just a note for everyone here: the program has been updated to version 1.1.

    Download is still here: http://javacool1.freeservers.com

    Size is now 48 kb.

    New features:
    -Added 29 new B3D/BDE registry keys to be deleted!

    I would recommend that everyone who downloaded the original file re-download to get the newest one. It finishes the job the first one started.  :)

    I was able to watch the processes of the B3D installation (original 1.0 version, all the way up to the newest version released just a couple days ago, I believe). The B3D Killer program now removes ALL traces of B3D\BDE from your system (from version 1.0 of B3D up to the newest version distributed on the web and through KaZaA 1.6, I have discovered).

    Strangely enough, it seems as though the absolute newest version of B3D is ONLY "available" through KaZaA - although I'm sure that will change soon (the official brilliant digital website's installer installs less files).
     
  17. Blacksheep

    Blacksheep Spyware Fighter

    Joined:
    Feb 9, 2002
    Posts:
    109
    Location:
    Missouri, USA
    Maybe this will interest you:

    http://news.com.com/2100-1023-875274.html
     
  18. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    :D Already saw that, but thanks!

    Unfortunately, the steps presented there do nothing for the registry entries - some of which allow the software to be re-install SILENTLY with no end-user knowledge when your browse a web page.

    If it were truly that easy to get rid of the scumware, I wouldn't have made the program to deal with it.  ;)

    I will gladly post the full list of registry entries that the program deletes if anyone is interested - its rather long.  :) However, there are quite a few entries that I found myself, and have not seen anywhere else.

    -javacool
     
  19. Blacksheep

    Blacksheep Spyware Fighter

    Joined:
    Feb 9, 2002
    Posts:
    109
    Location:
    Missouri, USA
    javacool your prog is great! :D

    I would suggest you post more prog info, and contact info on your download page?

    When this hits the Net big time you may be getting a lot of traffic.:)
     
  20. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    Exactly the problem - I haven't even sent information about it to sites such as slashdot since there IS a chance of it getting posted and the infamous "Slashdot effect" would not only render the page unviewable, but would exceed the monthly bandwidth limit on the free web hosting service in a matter of SECONDS.  :-/
     
  21. Blacksheep

    Blacksheep Spyware Fighter

    Joined:
    Feb 9, 2002
    Posts:
    109
    Location:
    Missouri, USA
    Hmm... dilemma! o_O There must be a way around the bandwidth problem. Mirrors?

    I think your prog should be made available to many! :D
     
  22. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    Thanks again for the complements.  :)

    And yes, mirrors would DEFINITELY be of some help. Hopefully, the small issue that prevented the download of it from wilders.org should be fixed soon, and that's at least one high-quality mirror.

    The program itself is very small, so if you manage to talk to anyone who has free webspace/bandwidth PLEASE  don't hesitate to have them contact me!  :) (They can contact me through the PM functions on these forums, most easily.)
     
  23. Mr.Blaze

    Mr.Blaze The Newbie Welcome Wagon

    Joined:
    Feb 3, 2003
    Posts:
    2,842
    Location:
    on the sofa
    =(i get error not a valid win 32 aplication error when i try to run it
     
  24. slawsk

    slawsk Guest

    i get that forbidden page.  how do i get it not to do that? :oops:
     
  25. Blacksheep

    Blacksheep Spyware Fighter

    Joined:
    Feb 9, 2002
    Posts:
    109
    Location:
    Missouri, USA
    Enable referrer logging and pop-ups.
     
Thread Status:
Not open for further replies.