Epicbot busted big time!

Today while i was downloading epicbot my Spybot S & D found w3i.IQ5.fraud Now u might ask urself what is this?

What is w3i.IQ5.fraud...? Adware / Downloader Entries named "InstallIQUpdater" and pointing to "?<$PROGRAMFILES>\W3i\InstallIQUpdater\InstallIQUp dater.exe? /silent /autorun". Please use Windows Explorer or another file manager of your choice to locate and delete these files.

FILES:

The file at "<$COMMONAPPDATA>\W3i\InstallIQUpdater\data.xm l".
The file at "<$COMMONAPPDATA>\W3i\InstallIQUpdater\iqu.ini ".
The file at "<$COMMONAPPDATA>\W3i\InstallIQUpdater\IQUMessageD lg.xsl".
The file at "<$COMMONAPPDATA>\W3i\InstallIQUpdater\updater.log ".
The file at "<$COMMONPROGRAMS>\InstallIQ Updater\InstallIQ Updater.lnk".
The file at "<$COMMONPROGRAMS>\InstallIQ Updater\Privacy Policy.url".
The file at "<$COMMONPROGRAMS>\InstallIQ Updater\Terms & Conditions.url".
The file at "<$COMMONPROGRAMS>\InstallIQ Updater\Uninstall InstallIQ Updater.lnk".
The file at "<$DESKTOP>\Free Dolphin Screensaver.lnk".
The file at "<$DESKTOP>\Free Whales ScreenSaver.lnk".
The file at "<$DESKTOP>\VIRUSfighter FREE Trial.lnk".
The file at "<$PROGRAMFILES>\Free Offers from Freeze.com\16700.url".
The file at "<$PROGRAMFILES>\Free Offers from Freeze.com\16714.url".
The file at "<$PROGRAMFILES>\Free Offers from Freeze.com\17418.url".
The file at "<$PROGRAMFILES>\Free Offers from Freeze.com\control.txt".
The file at "<$PROGRAMFILES>\Free Offers from Freeze.com\dolphinico.ico".
The file at "<$PROGRAMFILES>\Free Offers from Freeze.com\vfpro.ico".
The file at "<$PROGRAMFILES>\Free Offers from Freeze.com\whalesico.ico".
The file at "<$PROGRAMFILES>\W3i\InstallIQUpdater\InstallIQUpd ater.exe".
The file at "<$PROGRAMFILES>\W3i\InstallIQUpdater\iqu.xsl" .
The file at "<$SYSDIR>\killexplorer.bat".
Make sure you set your file manager to display hidden and system files.

FOLDERS:

The directory at "<$COMMONAPPDATA>\W3i\InstallIQUpdater\import" .
The directory at "<$COMMONAPPDATA>\W3i\InstallIQUpdater".
The directory at "<$COMMONAPPDATA>\W3i".
The directory at "<$COMMONPROGRAMS>\InstallIQ Updater".
The directory at "<$PROGRAMFILES>\Free Offers from Freeze.com".
The directory at "<$PROGRAMFILES>\W3i\InstallIQUpdater".
The directory at "<$PROGRAMFILES>\W3i".
The directory at "<$SYSDIR>\AI_RecycleBin\{5B0F14D3-0DD1-4336-9AFA-BE4A68909E5A}".
The directory at "<$SYSDIR>\AI_RecycleBin\{60C3E49E-B2D2-4CCD-A348-AD69E428F8AE}".
The directory at "<$SYSDIR>\AI_RecycleBin\{9FD0752F-AB97-4FCC-8E8D-49D44887E581}".
The directory at "<$SYSDIR>\AI_RecycleBin\{E01946F0-576E-4EA6-BBAD-4A8A89C9F7D1}".
The directory at "<$SYSDIR>\AI_RecycleBin\{F81F186C-CCDD-470B-A445-1E660C431A57}".
The directory at "<$SYSDIR>\AI_RecycleBin".
The directory at "<$WINDIR>\Installer\{8E1CB0F1-67BF-4052-AA23-FA22E948REGIS
Make sure you set your file manager to display hidden and system files.

REGISTRY :

You can use regedit.exe (included in Windows) to locate and delete these registry entries.

Delete the registry key "1F0BC1E8FB762504AA32AF229E84401C" at "HKEY_CLASSES_ROOT\Installer\Features\".
Delete the registry key "1F0BC1E8FB762504AA32AF229E84401C" at "HKEY_CLASSES_ROOT\Installer\Products\".
Delete the registry key "7zipap_1320" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Proce ss\".
Delete the registry key "Freeze.com" at "HKEY_LOCAL_MACHINE\SOFTWARE\".
Delete the registry key "instacodecs_1290" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Proce ss\".
Delete the registry key "W3i" at "HKEY_LOCAL_MACHINE\SOFTWARE\".

SO **** U EPICBOT U CAN BURN IN HELL!!!!!!!!!!!!!!! btw don't download any software that they provide.

Anywho got a question...I have deleted the programs, files and deleted the w3i.IQ5.fraud and scanned multiple times with Avast, Malwarebytes and Spybot S & D do u think my pc is clean? Using Mozilla Firefox > Adblocker. MyWOT, and all the other listed anti virus programs that i said earlier....

This is interesting Mite look into it a bit further

They have just made a mistake with the installer.

It's most likely a false positive

Yeah a "mistake"....everyone knows Epicbot is a virus ^_^

---------- Post added at 11:28 AM ---------- Previous post was at 11:20 AM ----------

Not that "freeze.com FREE OFFER" that site has a very poor repuation and is a adware that installs itself in other computers ......Don't really thikn that is meant to be a mistake really.....

---------- Post added at 11:29 AM ---------- Previous post was at 11:28 AM ----------

Note* Repuatation* Think* an*

Originally Posted by macke369

Yeah a "mistake"....everyone knows Epicbot is a virus ^_^

---------- Post added at 11:28 AM ---------- Previous post was at 11:20 AM ----------

Not that "freeze.com FREE OFFER" that site has a very poor repuation and is a adware that installs itself in other computers ......Don't really thikn that is meant to be a mistake really.....

---------- Post added at 11:29 AM ---------- Previous post was at 11:28 AM ----------

Note* Repuatation* Think* an*

The bot doesn't contain a Virus, only suspicious URLs from Advertisements.
Other Bots have the aswell but they are tarned.

Powerbot has suspicious ads , but 99% of all the ads are from Goldselling sites. Simba has actually none ^^

Probably because they don't have free scripts, and Epicbot does.

Powerbot and Simba have free scripts .....

Originally Posted by macke369

Powerbot and Simba have free scripts .....

That's true, but believe me, Powerbot has more Viruses than Epicbot...
I had the Source Code ;]

Not the Source Code they released for the Public, the Original one.

The client itself has no virus,.... it's the uploaded bots that people release that includes nasty stuff ^^ So therefore im using Avast Real time scanner + Spybot and Malwarebytes scanning almost everyday with them, and also scanning in safe mode once a week and the old virus/malware i have been having is from Epicbot....Anywho, im currently using Virtual Keyboard for extra protection against keyloggers ^^ Besides i don't really think that powerbot would make people only run 2 bots at a time and using at the same time malwares to infect other peoples computers ^^ Ofc u can buy VIP...but it just doesn't make any sense to me ...a hacking site wouldn't really want people to leave just to run multiple bots by buying VIP to run 6 or so. That would decrease their profit ravenue. Can't really explain , as im so f-ing tired atm. -.-

Simba > ALL
Cant believe I have to say this a lot. Simba is open source unlike all the other bots out there

We know that, bro ^^

Those are just advertisements put in a shitty way. The first PB client from Paris had a keylogger in it because he was still using that guy whose name starts with a J (i forget it's been how long?) who ragequit after Quarters left and Paris starting capitalizing off PB. Everythings been fixed for awhile now though, and if there was something suspicious I think ESET NOD32 would be able to find it.

Just use Simba. Way safer with its open source.

Yeah i know, this was my first time downloading Epicbot and i wanted to prove a point ^^ However Simbas scripts have alot of bugs + it takes some time to get a new script up that really works...^^ That's why RSBuddy has always been the best Runescape botting site =,( Rsbuddy <3 Powerbot has also a lot of working scripts with only minor bugs ^^

Epicbot busted big time!

Similar Threads

Tags for this Thread