- It monitors Internet access. When the user visits one of several financial or ISP Web sites, the Trojan horse captures sensitive information, such as log-in names, passwords, and other sensitive information. The Trojan horse then sends that information to a Web server for the Trojan horse’s author to retrieve. It installs a proxy server that configures the user’s computer for use as a relay for such actions as sending spam.
- It opens fake dialog boxes that prompt the user to enter confidential information, such as ATM card codes or credit card numbers. This information is then sent to a Web server for the Trojan horse’s author to retrieve.
Microsoft has released a tool to help you remove Backdoor:W32/Berbew Trojan horse variants from your computer. You can download this tool from the Microsoft Download Center and run it on your computer to remove Backdoor:W32/Berbew.A, Backdoor:W32/Berbew.B, Backdoor:W32/Berbew.C, and Backdoor:W32/Berbew.D, Backdoor:W32/Berbew.E, Backdoor:W32/Berbew.F, Backdoor:W32/Berbew.G and Backdoor:W32/Berbew.H infections.Technical updates
- February 8, 2005: Microsoft replaced this tool with the Microsoft Windows Malicious Software Removal Tool.
For more information about the Malicious Software Removal Tool, click the following article number to view the article in the Microsoft Knowledge Base:
The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000
- July 14, 2004: "Summary," "Resolution," and "Usage
Information" sections were updated.
- July 13, 2004: Microsoft released version 1.0 of the
Download.Ject Payload Detection and Removal Tool to the Microsoft Download
Center. Version 1.0 detects and removes all currently known variants (A to H)
of the Backdoor:W32/Berbew Trojan horse.
You may experience one or more of the following symptoms:
- Computer performance is decreased or the network
connection is slow.
- You receive messages or dialog boxes that request ATM
security numbers and credit card information when you visit certain online
financial and ISP Web sites.
This behavior occurs because your computer is infected with
the Backdoor:W32/Berbew Trojan horse. Backdoor:W32/Berbew is delivered by the
Download.Ject Trojan horse. For more information about how to determine if your
computer is infected with a variant of Backdoor:W32/Berbew, visit the following
Microsoft Web site:
Antivirus software with up-to-date signatures will help
prevent the Backdoor:W32/Berbew Trojan horse from infecting your
We also recommend that you use an Internet firewall and an
antivirus program with up-to-date signatures, and that you keep both Windows
and your programs up-to-date.
For more information about how to prevent viruses, and about how to recover from virus infections, click the following article number to view the article in the Microsoft Knowledge Base:
Computer viruses: description, prevention, and recovery
Download and setup information
The Download.Ject Payload Detection and Removal Tool has the
- Your computer must be running Microsoft Windows 2000 SP2
or later or a 32-bit version of Microsoft Windows XP.
- You must log on as a computer administrator or as a member
of the Administrators group.
For more information about how to determine whether a computer is running a 32-bit version of Windows XP or a 64-bit version of Windows XP, click the following article number to view the article in the Microsoft Knowledge Base:
How to determine whether your computer is running a 32-bit version or a 64-bit version of the Windows operating system
If these prerequisites are not met, the
installation will not work, and you will receive an error message. For more
information about the error message, view the following log file:
Additionally, we recommend that you install the Windows update to
disable the ADODB.stream object in Internet Explorer before you run the removal
tool. Although the removal tool will remove the Trojan horse from infected
computers, it will not prevent re-infection if your computer is still
vulnerable. By installing the critical update, you can help prevent additional
downloads of malware from a Download.Ject-infected
For more information about the Windows update to disable the ADODB.stream object, click the following article number to view the article in the Microsoft Knowledge Base:
How to disable the ADODB.Stream
object from Internet Explorer
You do not have to restart your computer after you install this
Before you follow these steps, make sure that you have backed up
all your important data.
When you install the Download.Ject Payload
Detection and Removal Tool and accept the end-user license agreement (EULA),
the installation package extracts the Berbcln.exe file to a temporary folder,
and then the removal tool runs. The removal tool verifies that your computer
meets the prerequisites that are listed in the "Prerequisites
" section. If the prerequisites
are met, the removal tool takes the following actions:
- The tool examines the following registry subkeys for
entries that the Trojan horse has added:
- The tool searches in memory for evidence of the main
Backdoor:Win32/Berbew Trojan horse component. If the removal tool finds this,
the process is ended.
- The tool searches for the following data files that the
Trojan horse created. These files may contain sensitive personal data. The tool
deletes these files.
- The tool deletes all the files that are associated with the
Backdoor:W32/Berbew Trojan horse. These files were identified in steps 1 and
- The tool removes the registry entries that it identified in
step 1. If a Berbew registry value no longer points to a file on the hard disk,
the removal tool does not remove the orphaned registry value because the
registry value will not cause any damage if the associated file does not exist
on the hard disk.
- As part of its method of operation, the Trojan horse runs
two instances of Microsoft Internet Explorer in hidden windows. These windows
try to connect to malicious Web sites. One instance tries to upload stolen
personal data, and the other instance looks for software updates for the Trojan
horse. If the tool detects the Backdoor:W32/ Berbew Trojan horse on the
computer, the tool ends all currently running instances of Internet
- The tool displays a message that describes the outcome of
the detection and removal process. The following list contains the messages
that you may receive, and it explains their meanings.
When you close the message box, the removal tool quits, and
the Berbcln.exe file is deleted from the temporary folder. You can now delete
the Windows-KB873018-ENU-V1.exe file manually.
Collapse this tableExpand this table
|No infection detected||The Backdoor:Win32/Berbew
Trojan horse was not detected on this computer. |
|Successfully removed Backdoor:Win32/Berbew.gen Trojan. To
prevent malicious communication, all instances of Internet Explorer were
terminated.||The Backdoor:Win32/Berbew Trojan horse was removed. No
additional action is required.|
|This tool must be run by an administrator.||You
must log out and log on again as an administrator.|
|Fatal error, please review log file.||See the
%Windir%\Debug\Berbcln.log directory for more information.|
|Backdoor:/W32/Berbew.gen Trojan was detected, but could
not be removed.||Try to run the tool again and check the log file for
|This tool requires Windows 2000 or Windows
XP.||This tool is not supported on versions of Windows other than
Windows 2000 and Windows XP.|
|Incorrect Windows version (Win32s)||This tool is
not supported on Windows 3.1 with Win32s.|
- The removal tool creates a log file named Berbcln.log in
the %Windir%\Debug folder. You can view this log file to determine if
Backdoor:W32/Berbew.gen infections were detected and were removed.
The removal tool installer supports the following command-line
- /Q - Use quiet mode or suppress messages when the files are being
- /Q:U - Use user-quiet mode. User-quiet mode displays some dialog boxes
to the user.
- /Q:A - Use administrator-quiet mode. Administrator-quiet mode does not
present any dialog boxes to the user.
path - Specify the location of the temporary folder that is used by
the Download.Ject Payload Detection and Removal Tool Setup program, or specify
the target folder for extracting files (when this switch is used together with
the /C switch).
- /C - Extract the files without installing them. If
path is not specified, you are prompted to specify a target folder.
cmd - Specify the path and the name of another Setup.inf file or an
.exe file to use to install the tool.
- /R:N - Never restart the computer after installation.
- /R:I - Prompt the user to restart the computer if a restart is
required, except when this switch is used with the /Q:A switch.
- /R:A - Always restart the computer after installation.
- /R:S - Restart the computer after installation without prompting the
For more information about the supported installation switches, click the following article number to view the article in the Microsoft Knowledge Base:
Command-line switches for IExpress
software update packages
The removal tool supports the following command-line
- /S - Enables silent mode for the tool. This switch suppresses the
infection status dialog box that you receive after the tool has run.
The Berbcln.exe file is automatically deleted from its temporary
location after the removal tool runs. You can delete the tool's installer
package after you install the removal tool.Note
After you install the Download.Ject Payload Detection and Removal
Tool, it does not appear in the Installed programs
list in the
Add/Remove Programs tool in Control Panel.
In more recent versions of Robocopy, such as version XP010, the /SECFIX
switch has been deprecated. To refresh security information for existing destination files and folders without copying file data, use the /IS
switch together with the /COPY
switch without the D flag. For example, /IS /COPY:SOU
refreshes all security information for all selected files without copying any file data. For more information, see the "Selectively Copying File Data" topic in the Robocopy.doc file.
for other considerations.
Article ID: 873018 - Last Review: December 1, 2010 - Revision: 6.0
- Microsoft Windows XP Professional
- Microsoft Windows XP Home Edition
- Microsoft Windows XP Tablet PC Edition
- Microsoft Windows XP Media Center Edition 2005 Update Rollup 2
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Professional Edition
- Microsoft Windows 2000 Server
- Microsoft Windows Server 2003, Standard Edition (32-bit x86)
|kbpubtypekc atdownload kbqfe kbsecurity kbsecbulletin kbsecvulnerability kbbug kbfix KB873018|