Welcome to WebmasterWorld Guest from 107.22.7.35

Forum Moderators: phranque

Message Too Old, No Replies

New User ID created on my PC

IWAP_WWW created by spyware?

     
8:56 pm on Jun 22, 2004 (gmt 0)

10+ Year Member



Anyone else encounter this little piece of software on their PC? I can't find any documentation yet of it, but know one other person who has had in on their PC.

It created it's own user account by the name of IWAP_WWW with admin rights. Doesn't seem like a friendly thing to do.

Any info appreciated.

9:03 pm on Jun 22, 2004 (gmt 0)

WebmasterWorld Senior Member encyclo is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Taking a guess here...Try this site (delinked for obvious reasons): soft.iwap.biz?
9:11 pm on Jun 22, 2004 (gmt 0)

10+ Year Member



I have the usual suspects when it comes to spyware checking, spybot, adaware, pest patrol, hijack this, they do not have any documentation concerning this.
9:43 pm on Jun 23, 2004 (gmt 0)

10+ Year Member



please help. this iwap_www is driving me nuts, is there any relief in sight. Are thier any solutions to the problem.
9:44 pm on Jun 23, 2004 (gmt 0)

10+ Year Member



as a first step, you might want to delete that user acct
8:52 pm on Jun 24, 2004 (gmt 0)

10+ Year Member



Seems symantec have picked it up now and given it a name
backdoor.berbew.F
follow their instructions and also delete that extra user ID.
11:52 pm on Jun 24, 2004 (gmt 0)

WebmasterWorld Senior Member encyclo is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Nice find, AmericanBulldog! Removal instructions can be found here [sarc.com].

As the trojan has a password-sniffing feature, don't forget to change all you passwords, especially for things such as online banking, after having removed the trojan.

Of course, you should also get all the critical updates from Windows Update and for your anti-virus software, and check the configuration of your firewall to reduce the risk of getting infected in the future.

4:17 am on Jun 30, 2004 (gmt 0)

10+ Year Member



Any new info on this? One of our home PCs running XP has it. I've deleted the account. Will try to clean tomorrow. Note: the Symantec site doesn't specifically mention IWAP_WWW.

TIA,

- John

5:19 am on Jun 30, 2004 (gmt 0)

10+ Year Member



It is related to this
[webmasterworld.com ]

more information is here

[isc.sans.org ]

I am guessing you might want to change browers.

 

Featured Threads

Hot Threads This Week

Hot Threads This Month