A trojan called dlder.exe is hidden in a mutlitude of p2p apps.

The most prominent are Kazza and Limewire, Grokster, and the new Bearshare Beta.

It is a hidden part of the ClickTiluWin adware. The people of Limewire and kazza and Bearshare did not even know it was a trojan.

This is a newly discovered trojan, but it has been in distribution for quite some time. Tens of thousands must have been infected.


For more information see the Bearshare forums


Description which is somewhat incomplete:
The following was obtained from TrendMicro
W32.DlDer.Trojan

TROJ_DLDER.A
(continued from profile page)

In the wild: No
Detection available: December 27, 2001
Detected by pattern file#: 191 or 991
(note about pattern numbering)
Detected by scan engine#: 5.200
Language:
English
Platform: Windows
Encrypted: No
Size of virus: ~31,232 bytes / ~40,960 bytes

Details:
This trojan is a Visual C++ compiled program. Upon execution it drops a file named DLDER.EXE under the %windows% directory. It adds the registry entries:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run
Dlder=“%windows%\dlder.exe”
HKEY_LOCAL_MACHINE\Software\games\clicktilluwin

After modifying the registry, the trojan connects to the site and provides the user's IP address and default browser. It then sends an incrementing integer that possibly indicates the number of infected computers.

This trojan program is also installed along with two file-sharing programs, Grokster 1.3.3 and LimeWire 2.0.2. Both programs are downloadable from the website Grokster is downloaded from the *US-site* as SETUP.EXE and LimeWire as LIMEWIREWIN.EXE.

Upon installation of these file-sharing programs, TROJ_DLDER.A is also installed on the computer without the user’s knowledge. Aside from the file DLDER.EXE in the %windows% folder, a hidden folder named "explorer" is also created in the %windows% folder. The hidden folder contains a file named EXPLORER.EXE. The following files are also created:

C:\Program Files\Clicktilluwin\clicktilluwin.htm
C:\Program Files\Clicktilluwin\game.ico
C:\Windows\Start Menu\Programs\Clicktilluwin\clicktilluwin.lnk
C:\Windows\Desktop\Clicktilluwin.lnk


It may also add the registry entry:

HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Run:
Dlder = "%windows%\explorer\explorer.exe"

If the downloads from LimeWire.com do not contain this trojan then you need to stop spreading this false information. You should always download from the companies own location for any product you may want. Third-party downloads may result in each things being added than otherwise would not be. But since I run FreeBSD http://www.freebsd.org , I dont have to worry about spayware or any kind of stupid Windows non-sense like this. :]

the trojan is bundled with the installer

no seperate download required

Then download the "Other" package from http://www.limewire.com/index.jsp/download_other , its a zip.

Symantec just identified this trojan on my computer and I downloaded LW 2 from Limewire.com. Yet another reason to stop using Limewire.

I just downloaded from limewire directly as well, and Norton popped right up..

w32.DlDer.Trojan,

altho it was in the Ctywinstaller.exe file

temp/RarSFX/dlder.exe

yet another reason? it wasnt just limewire... i thought it was just bearshare, but after reading this, it is the ad-ware people.. burn them at the key board!!
Becker

I recomend getting ad-aware.
Ad-Aware @ Lavasoft - The Original Anti-Spyware Company - Lavasoft (both in english and totally free)

Ad-aware is a program that detects spyware on your computer. I keep it on my desktop and scan my PC whenever I download anything from the Internet. I feel bad for those unsuspecting people that are not aware of the spyware secretly being installed. Kind of like Cowards hiding and blending in amoungst us... remind you of anyone?

The trojan in:

- Bearshare 2.4.0 Beta 7
- LimeWire 2.02
- Kazaa (unspecified versions)
- Grokster 1.33
- Net2Phone (unspecified versions)

will eventually start popping up adverts in IE (even when not online).

Ad aware - when I last checked - does not remove this. Nor will Norton.

If you've not installed LimeWire 2 - then do not install it. This needs to be sorted first.