Heads Up! Someone is posting xupitor spyware link; Don't open it!

1/27/2003 | self

[FBD]

Heads up to Jim Rob and all.

I clicked on a link on a post here at FR couple of days ago, and accidentaly got xupitor.com spyware installed on my computer!

It looked harmless enough, and I thought I was going to a site to look at an article; but it changed my browser settings, tool bar, and added a bunch of "favorites", like online gaming sites, etc. Now, whenever I do a search, it directs me back to xupitor.com. This AM, I got some garbage, and a whole bunch of windows popping up behind my active window. My McCaffee Firewall starting screaming at me about a port attack...

Help from the savvy, as from what I can figure out so far, this is a hard program to get rid of. Heads up to all, and help requested.

[FBD]

Thanks for the info guys, I'm going to the spybot.com site now.
Sure wish I could find the post by that jerk that I clicked on. grrr...

[nina0113]

Just taking it out of startup doesn't work - I had to erase my computer (I ghosted it from a network image so that wasn't such a big deal). Xupiter burrows down into low-level registry files, even ad-aware won't remove it (though it claimed to, when I ran that).

[Sir Gawain]

Spybot S&D should find the reg files. If not, run RegScrubXP after you run Spybot.

[nina0113]

I downloaded spybot for next time, but Ad-aware said it was removing the reg files, and xupiter came back a couple of reboots later anyway. We're running Win2K here, so I'm not sure RegScrubXP will work - again, since I can just move my data files to the network & re-ghost the machine, spyware is just an afternoon's inconvenience.

[Sir Gawain]

RegScrubXP will work on 2000 and XP. It's the best. I have GoBack for problems that can't be fixed.

[Bloody Sam Roberts]

Just downloaded Spyware.

You mean Spybot Search and Destroy I think.

Yes, just double click the file you downloaded to install it then go to the "settings" area on the left side of the window and you can configure it any way you want.

For now I would recommend only allowing it to "fix" the items in red that come up checked off after a search. The items in blue/green aren't absolutely essential to the running of the machine but you'll lose a lot of settings /cookies that you may want to keep.
Even if you do delete something you want back, the software makes automatic backups and you can go to "Recovery" to get them back. Good luck!

[spudsmaki]

I spend my life and make my living dealing with this rubbish.

Assuming you're using a variant of Win98/Me, press the 3 finger salute JUST ONCE to bring up the task list. The only two items you absolutely need are systray and explorer, and maybe Rnaapp if you have dialup modem. The explorer isn't IE, it just has the same name. You'll likely find a dozen or more things. Cancel them one at a time, works for this session only.

To stop these permanently, type in msconfig in Start->Run. Just look at all the stuff under the Startup tab. Sometimes what it is is just a mystery.

Another utility is msinfo32, often perusing its long lists will tell you where it came from.

A site that has started compiling a list of these bad actors is answersthatwork.com. Look the the "Task List."

Well, this is a running start. Better yet, get yourself a CD of Knoppix Linux and give that a whirl. It runs from the CD without munging your disk, and its cheap. Try it, you might like it.

[HairOfTheDog]

I wouldn't assign any kind of blame on the poster either on the amount of information we have, which is NONE. :~D

FBD.... how are you so sure which link caused it if you can't remember the post where you clicked it? Or who it was? Or when it was? This thread is just not very helpful. Doing a self-search, finding out where and when the problem was, reporting it directly so the mods can kill the link, all those things would have been more helpful than the amount of time spent on this thread.

Carry on!!

[widowithfoursons]

Well, I don't know how to do that. It just downloaded, and I hit "Finish". Am I scr*wed?

[nutmeg]

I got hit by this Xupiter menace also (WHAT a pain!). I thought I got rid of it, but I see it's still listed when I right-click my toolbar at the top of my IE 5.5 browser.

[nutmeg]

FYI

[HAL9000]

I'm half scared to click on an external link here at FR, now.

If you're running Windows, you should be scared to click on a link anywhere. It is possible to destroy the operating system just by clicking on a malicious link.

[Boot Hill]

If you want to find the thread with the deadly link, type [Ctrl]+[H] to see your history list. Scroll down the list and click on the threads that seem most likely.

BTW, what are you doing rummaging around the internet with a fire wall?

--Boot Hill

[nutmeg]

Sure wish I could find the post by that jerk that I clicked on. grrr...

Same here! I have no idea where I picked it up from either.

[nutmeg]

FYI

[spudsmaki]

And I should have mentioned, klez has gotten popular again. I've gotten a dozen emails in the last few days from legit sources that had it. I am using Norton Antivirus.

I definitely don't use Internet Exploder and Outlook Depressed.

[dyed_in_the_wool]

I'm half scared to click on an external link here at FR, now.

You should always be half-scared to click on ANY link. That's just common sense.
You might want to consider another browser, like Mozilla.
It can be configured to block pop-ups, doesn't have the scripting security issues IE does and it's FREE.
Unfortunately, it is a BIG download, so if you're on dialup, you might be out of luck. Even Phoenix, the smaller iteration is 6 megs.
Always check your status bar and verify where you're going next. Good luck. Oh, and Ad-Aware rocks.

[FBD]

Sorry, but I know it was here. I recall clicking on the link, and it appeared harmless enough, when I opened it.
It was the only thing there, and I moved on to other posts.

I was also asking for help to get rid of it, and also a heads up. Some folks(like me!) aren't as 'puter savvy as some folks, (like you!) are.

[FBD]

I deleted my history list, as well as cookies, etc, trying to get rid of xupitor.

What am I doing rummaging around with a fire wall?

I don't know, I thought that was enough. I am on cable broadband.
So I need a router, or something, right?

[B Knotts]

A firewall doesn't generally protect you from clicking on links or downloading malicious software.

The only things that can protect you from common malware in that regard are:

1. a more secure web browser
2. a more secure operating system

Even then, you always have to be wary of where you click.

Indeed, compatibility with the most common software is a double-edged sword. As is "ease of use."