Stop Sign trojan ?? download.wren.a

Discussion in 'Trojan Defence Suite' started by mikeyB, Mar 15, 2004.

Thread Status:
Not open for further replies.
  1. mikeyB

    mikeyB Guest

    I am testing a application at the moment for www.newbie.org called stop sign to see if it has a malicious trojan in it. On instal when a free AVG application was active, it detected a trojan called DOWNLOAD.WREN.A I have been unable to find this trojan anywhere on the web! - for testing purposes I had to uninstall the AVG free app and then instal the stop sign application, all went through fine.

    I have now installed the trial copy of TDS-3 to see if it could find a trojan on the supposidly infected PC, but was unsuccessfull?? is this really a trojan or did the anti virus application identify a bogus trojan or is it a spoofed nameo_O

    Any help would be usefull.

    Many Thanks

    MikeyB
     
  2. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,330
    Location:
    Netherlands
    Hi mikeyB,

    Warnings on Stop-Sign:
    http://www.doxdesk.com/parasite/DownloadReceiver.html
    http://www.safersite.com/PestInfo/S/StopSign.asp

    Regards,

    Pieter
     
  3. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi MikeyB & welcome :)
    In TDS3 you need to enter the Scan control and tick all the various Scans, then run a full scan, BTW this will take some time on large hard disks.
    When searching for this file manually please ensure that you have "Show hidden" enabled in your file manager (desktop explorer) If you find the file then please zip it up & submit it to:
    submit@diamondcs.com.au for analysis:

    Thanks. Pilli
     
  4. mikeyB

    mikeyB Guest

    thanks for the quick responces guys..really appreciate it, pilli - i did go into the TDS scan control and enabled everything on the 1st scan after downloading it, I was warned that the radian (i think they were called) were out of date.. i then went tot the site listed and downloaded them and replaced the file that was on my machine! another scan..still nothing ?! I was under the impression that TDS would find almost any trojan, I hope so :)

    also thats peitre, I have read the URL on pest patrol, will scan with it tonight when i get home and see what smokes!

    Thanks

    MikeyB
     
  5. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Best of luck with your search mikeyB, it may not be a Trojan but some other malware such as a dialer.
    If you still have doubts go to the hijack this forum here at Wilders and follow the instruction for HJt, post your results and the experts there will be able to give an opinion for you. :)
     
  6. mikeyB

    mikeyB Guest

    Just a quick question, before I look at purchasing TDS-3 is there a easy method or auto remover of trojans in this package - if it detects them? Or even better a URL or document you can point me to to tell me how to do it?

    Or is it just a detection utility and not a cleaner?

    Sorry to hassle you..

    MikeyB
     
  7. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    No problem mikeyb, When malware if found by TDS you get the option to delete - submit it etc.

    You will find much more information in the TDS help file :)

    Don't fproget to look at the special purchase offers on the DCS website and also the very useful free tools.

    www.diamondcs.com.au
     
  8. Jasmin

    Jasmin Guest

    Hello all,

    I downloaded a free anti virus software called Stop Sign, What a mistake that was!!

    i see that MikeyB found a trojan called DOWNLOAD.WREN.A i too have this virus. Unfortunatly, i find complex removal difficult as i am partialy blind,

    Please please please does anyone know of a automatic removal tool for this nasty trojan?

    Or will the nice people at TDS be looking into finding a clean-up for this trojan.

    Many thanks

    Jasmin
     
  9. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,330
    Location:
    Netherlands
    Hi jasmin,

    As far as I know Spybot S&D removes StopSign.
    So you can download Spybot - Search & Destroy
    After installing, first press Online, and search for, put a check mark at, and install all updates.
    Next, close all IE windows, hit 'Check for Problems', and have SpyBot remove all it marks in red.

    Regards,

    Pieter
     
  10. Jasmin

    Jasmin Guest

    Hi Pieter,

    I already am well versed in anti spyware, i use spybot s&d, spyware blaster, adaware and spyhunter - as you can guess i don't like spyware :) , none of them can find this little trojan! I have posted and searched until my little fingers got sore! do you know if TDS are looking into targeting this monster?

    Thanks

    Jasmin
     
  11. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    4,449
    Location:
    North Carolina, USA
    Hi Jasmin,

    Have you tried this:

    There should be a 'Download Receiver' entry in the Control Panel's Add/Remove Programs option. After removing the software you should be able to delete download.exe, eac_drec.dll and systimer.exe from the eAcceleration folder in Program Files\Common Files. You can delete the folder itself if you have nothing else installed from eAcceleration (eg. eAnthology).

    Taken from this website that Pieter posted above in reply # 1?

    Regards,
    Kent
     
  12. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,330
    Location:
    Netherlands
    Hi Jasmin,

    I would not expect them too, since StopSign is generally considered adware: http://pestpatrol.com/PestInfo/S/StopSign.asp

    Could you jump to Step 2 of this post:
    http://www.wilderssecurity.com/showthread.php?t=15913
    With any luck I should be able to help you get rid of it if you post your HijackThis log.

    I think I will move this thread to that section later on, anyway.

    Regards,

    Pieter
     
  13. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Please do exactly as Pieter says, each step. I jsut googled around and saw some forums where things went wrong (they had not Pieter or another known HJT specialist at hand it seems) and only because ther person had a good backup had not lost everything after a necessary reformat in that case.
    Be sure Pieter does what ever is possible to save your system.
    I was not aware yet that this parasite can be so nasty!
    I must congratulate you though, that you found your way to this serious forum where you will only be advised the good stuff and programs which are seriously there for your protection etc and free where possible!
     
  14. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi Jasmin, Good advice frome Pieter & Jooske.

    TDS is mainly a Trojan killer although does cover some spyware such as keyloggers and other malware.

    Unfortunately many sites can download commercial programmes which include spyware merely because you accept their Terms & conditions. So read them & any privacy statements before agreeing, particlarly difficult for someone in your position I know but they can do it - A case of user beware :(

    HTH Pilli
     
  15. Neil

    Neil Guest

    Hi
    I have a mate's computer here to try and sort out a virus called downloader.Wren.b
    AVG picks it up every time, but I can not delete it or heal it.
    It is giving me major problems.
    If you come up with a solution, I would be very grtefull of any info.
    Thanks
    Neil
     
  16. Reaper-X

    Reaper-X Guest

    Use 2 virus scanners... For example... AVG and mcaffe.... If you have a virus that AVG finds but cant pic up...write the directory down and quarantine it using mcaffe Then send to Avert and Delete.
     
  17. davidnason

    davidnason Registered Member

    Joined:
    Mar 21, 2005
    Posts:
    2
    Location:
    Seattle, WA area


    MikeyB,

    DOWNLOAD.WREN.A was the name once given to the stub installer once used by eAcceleration in its StopSign antivirus product. Its actual filename was wren.exe. It was not a trojan or any other form of malware.

    StopSign has been evaluated and reviewed by Microsoft, Norton, McAfee, AVG, PestPatrol and many others and has been determined to free of any spyware, adware, or other form of malware.

    Cheers,
    David Nason
    CTO
    eAcceleration Corp.
     
  18. Notok

    Notok Registered Member

    Joined:
    May 28, 2004
    Posts:
    2,969
    Location:
    Portland, OR (USA)
    Amazing.. this thread hasn't been posted to since November of last year, but the CTO of Stop-Sign posts to it just hours after I was looking at it because of a system I was working on that was having problems with Stop-Sign :eek:

    Honestly, they may have cleaned up their act, but trust doesn't return that easily for me. There are plenty of other (Free!) apps that will do the same thing but much better.
     
Thread Status:
Not open for further replies.