Welcome to WebmasterWorld Guest from 54.204.189.167

Forum Moderators: phranque

Message Too Old, No Replies

New User ID created on my PC

IWAP_WWW created by spyware?

     
8:56 pm on Jun 22, 2004 (gmt 0)

Preferred Member

10+ Year Member

joined:Nov 22, 2002
posts:403
votes: 0


Anyone else encounter this little piece of software on their PC? I can't find any documentation yet of it, but know one other person who has had in on their PC.

It created it's own user account by the name of IWAP_WWW with admin rights. Doesn't seem like a friendly thing to do.

Any info appreciated.

9:03 pm on June 22, 2004 (gmt 0)

Senior Member from CA 

WebmasterWorld Senior Member encyclo is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Aug 31, 2003
posts:9073
votes: 4


Taking a guess here...Try this site (delinked for obvious reasons): soft.iwap.biz?
9:11 pm on June 22, 2004 (gmt 0)

Preferred Member

10+ Year Member

joined:Nov 22, 2002
posts:403
votes: 0


I have the usual suspects when it comes to spyware checking, spybot, adaware, pest patrol, hijack this, they do not have any documentation concerning this.

Sean Spruill

9:43 pm on June 23, 2004 (gmt 0)

Inactive Member
Account Expired

 
 


please help. this iwap_www is driving me nuts, is there any relief in sight. Are thier any solutions to the problem.
9:44 pm on June 23, 2004 (gmt 0)

Full Member

10+ Year Member

joined:Feb 26, 2003
posts:212
votes: 0


as a first step, you might want to delete that user acct
8:52 pm on June 24, 2004 (gmt 0)

Preferred Member

10+ Year Member

joined:Nov 22, 2002
posts:403
votes: 0


Seems symantec have picked it up now and given it a name
backdoor.berbew.F
follow their instructions and also delete that extra user ID.
11:52 pm on June 24, 2004 (gmt 0)

Senior Member from CA 

WebmasterWorld Senior Member encyclo is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Aug 31, 2003
posts:9073
votes: 4


Nice find, AmericanBulldog! Removal instructions can be found here [sarc.com].

As the trojan has a password-sniffing feature, don't forget to change all you passwords, especially for things such as online banking, after having removed the trojan.

Of course, you should also get all the critical updates from Windows Update and for your anti-virus software, and check the configuration of your firewall to reduce the risk of getting infected in the future.

its4jag

4:17 am on June 30, 2004 (gmt 0)

Inactive Member
Account Expired

 
 


Any new info on this? One of our home PCs running XP has it. I've deleted the account. Will try to clean tomorrow. Note: the Symantec site doesn't specifically mention IWAP_WWW.

TIA,

- John

5:19 am on June 30, 2004 (gmt 0)

Full Member

10+ Year Member

joined:Jan 30, 2004
posts:260
votes: 0


It is related to this
[webmasterworld.com ]

more information is here

[isc.sans.org ]

I am guessing you might want to change browers.