Skip to comments.
Heads Up! Someone is posting xupitor spyware link; Don't open it!
1/27/2003
| self
Posted on 01/27/2003 8:09:44 AM PST by FBD
Heads up to Jim Rob and all.
I clicked on a link on a post here at FR couple of days ago, and accidentaly got xupitor.com spyware installed on my computer!
It looked harmless enough, and I thought I was going to a site to look at an article; but it changed my browser settings, tool bar, and added a bunch of "favorites", like online gaming sites, etc. Now, whenever I do a search, it directs me back to xupitor.com. This AM, I got some garbage, and a whole bunch of windows popping up behind my active window. My McCaffee Firewall starting screaming at me about a port attack...
Help from the savvy, as from what I can figure out so far, this is a hard program to get rid of. Heads up to all, and help requested.
TOPICS: Free Republic; Your Opinion/Questions
KEYWORDS: adaware; extenallinks; internetparasites; spybot; spyware; xupitor
Navigation: use the links below to view more comments.
first previous 1-20, 21-40, 41-60, 61-80 ... 101 next last
To: nutmeg
I will find the thread I picked it up on, as I remember posting to it.
Just got done downloading SpyBot Search and Destroy.
Xupitor had loaded 61 files to my hard drive. Only one of them was visible. After reboot, looks like it's gone.
41
posted on
01/27/2003 9:54:27 AM PST
by
FBD
To: Formerly Brainwashed Democrat
What kind of computer do you have and what system are you running. I had a problem with something my son put on my computer and I finally ran Restore and it's gone. It was so easy, after spending hours trying to find the darn thing and delete it.
42
posted on
01/27/2003 9:58:11 AM PST
by
Eva
To: Formerly Brainwashed Democrat
FWIW: (According to my son)
Quote:
"To remove the Xupiter crap, you have to do a regedit and search and destroy on anything Xupiter.
Then, navigate to Windows\system32\Drivers\etc and open the Hosts file (the one with NO extension) with Notepad and change ALL the settings that refer to Xupiter and (I think, 3 others) to: 127.0.0.1 in place of the ip numbers that are there.
AdAware does NOT remove this Hijackware. In fact, since AdAware has NOT been updated, and will NOT be updated until the next version, it has been suggested to NOT use AdAware any longer, as it can remove some things that you actually need.
Just went thru this on a client's machine."
Endquote__________________________
To: Sir Gawain
Thanks for the link to Spy Bot! I just got done running it, and looks like I got rid of Xupitor.
What kind of creeps would design stuff like that?
Never mind, I know what kind. It was a rhetotical question...thanks again!
I've got a lot to learn. I think I won't be doing any more online banking, however. Should I cancel my accounts online, or at least reset them?
FRegards,
FBD
44
posted on
01/27/2003 10:00:44 AM PST
by
FBD
To: egarvue
AdAware removes the spyware junk from your system.
45
posted on
01/27/2003 10:03:12 AM PST
by
TheJollyRoger
(Remember the Alamo.)
To: Eva
I've got a new machine with a Pentium 4, running Windows XP.
According to the gurus here, Windows isn't safe. So I'm going to check out Mozilla, etc.
See post #7 by Sir Gawain.
Spyware is embedded, I guess. Clicking restore doesn't get rid of it. After running the Spy Bot, it got rid of Xupitor.
It had 61 files on my hard drive, and only 1 was visible.
It's gone now.
46
posted on
01/27/2003 10:09:29 AM PST
by
FBD
To: PAR35
I use it. Good program.
47
posted on
01/27/2003 10:12:51 AM PST
by
jude24
To: dyed_in_the_wool; HAL9000
Thanks for the advice, and help.
48
posted on
01/27/2003 10:14:08 AM PST
by
FBD
To: Rightly Biased
bump to self for later read at home
To: Formerly Brainwashed Democrat
You must not have gone back far enough with the Restore, because it got rid of all my problems.
I wouldn't worry to much about Windows. There are alot of anti-Microsoft people on FreeRepublic, but there are alot more who disagree. All the information about the latest problem said that if they had downloaded the Windows updates they would not have had a problem.
50
posted on
01/27/2003 11:09:09 AM PST
by
Eva
To: Formerly Brainwashed Democrat
it wont let you delete it because it is probably running at the time.
You need to look at your 'startup' and autoexec and anything else that runs at re-boot.
51
posted on
01/27/2003 11:37:43 AM PST
by
Mr. K
(all your TAG LINE are belong to us)
To: Formerly Brainwashed Democrat
I have Norton Systemworks 2002 Pro running and just did a Memory Identification. These file came up and I can't identify what they do or where they are from:
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SLLIGHTS.EXE
Can anyone tell me if these are bad? What would I lose if I were to dump them?
I also have been running Ad Aware for about 2 months and it seems to work very well keeping my cookies from loaded up from spyware.
Each time I get a new pop-up window, I right click on it and copy the URL up to the end of .com and add it to the list of restricted sites. The drill is:
In IE, click on tools. Click on the dropdown menu of Options. Then click the Security tab and then click on Restricted sites, then click on Sites. This brings up a slot "Add this Web site to the zone: where I paste the URL and then click Add. Here is the list of sites I have added to my restricted site list. For heavens sake don't click on any of these links. I put them in a format so they shouldn't be hot links.
Web sites that have either popped up or have generated bad cookies:
http://ad.doubleclick.net
http://m2.doubleclick.net
http://m.doubleclick.net
*.doubleclick.net
*.doubleclick.com
*.fastclick.net
*.doubleclick.com
*.fastclick.net
*.fastclick.com
http://ads.x10.com
*.x10.com
http://cserver.mii.instacontent.net
*.x10.com
http://cserver.mii.instacontent.net
*.instacontent.net
*.instacontent.com
http://ww2.weatherbug.com
*.weatherbug.com
http://ww2.weatherbug.com
*.weatherbug.com
http://www.sharewareonline.com
http://banners.valuead.com
http://banners.valuead.net
http://ads.yourfreedvds.com
http://banners.valuead.net
http://ads.yourfreedvds.com
http://ad.trafficmp.com
http://images.trafficmp.com
http://a248.g.akamaitech.net
http://www.netvisionsenterprises.com
http://a248.g.akamaitech.net
http://www.netvisionsenterprises.com
http://z1.adserver.com
http://www.angelfire.com
http://us.a1.yimg.com
http://www.image.ft.com
http://us.a1.yimg.com
http://www.image.ft.com
http://info.accumail.com
http://shopping.webmarket.com
http://amch.questionmarket.com
http://clickit.go2net.com
http://amch.questionmarket.com
http://clickit.go2net.com
servedby.advertising.com
http://servedby.advertising.com
http://bannerfarm.ace.advertising.com
servedby.advertising.net
http://bannerfarm.ace.advertising.com
servedby.advertising.net
*.servedby.advertising.*
servedby.advertising.us
*.servedby.advertising
http://img.mediaplex.com
*.servedby.advertising
http://img.mediaplex.com
http://view.atdmt.com
http://spd.atdmt.com
http://www.flowgo.com
http://www.linkfinding.com
http://www.flowgo.com
http://www.linkfinding.com
http://ads.fortunecity.com
http://www.fortunecity.com
http://a.tribalfusion.com
http://ad.smni.com
http://a.tribalfusion.com
http://ad.smni.com
http://static.smni.com
http://ads.hitcents.com
http://radiop1.xr1.net
http://ad.linksynergy.com
http://radiop1.xr1.net
http://ad.linksynergy.com
http://www.jit-software.com
http://www.hotels.net
http://www.perfiliate.com
http://www3.bannerspace.com
http://www.perfiliate.com
http://www3.bannerspace.com
http://global.msads.net
http://subs.timeinc.net
*.valueclick.net
*.valueclick.com
*.valueclick.net
*.valueclick.com
*.valueclick.org
*.valueclick.usa
*.valueclick.info
http://www.youclick2earn.com
*.valueclick.info
http://www.youclick2earn.com
http://63.246.3.5
http://209.164.32.120
http://208.253.92.54
Some of these might be redundant, but this list is working. Very seldom does Ad Aware find any new offending cookies now.
To: That Subliminal Kid
I agree about Ad-Aware (that's a link to the latest retail version - older versions at download.com). It's a great product. I run it on all of my PC's once a month. My Norton Firewall settings block most such spyware and I don't install any software that I am not already pretty sure about, so I have never found any spyware on any of my systems. On the other hand, Ad-Aware has found and eliminated many spyware apps on machines belonging to my clients.Before installing a program that you aren't sure of, go to SpyChecker or Tom-Cat.com Spyware List and search for the name of the product that you are going to install. You will be surprised at some of the names on the list. Notice that Aureate SpamKiller is on the list. Use iHateSpam instead. Also, CuteFTP is confirmed as containing spyware. Use WS_FTP instead. And it's not just small names either. Windows Media Player 7 and 8 (version 9 is under investigation), Windows XP Search Assistant, Lexmark Print drivers installation, Netscape 6 through 7 (only logs use of search button) and RealPlayer 7 are just a few of the big names that are known to contain spyware.
Good Luck.
To: Formerly Brainwashed Democrat
I forgot to ping you on post 53. There are several good links there.
To: Formerly Brainwashed Democrat
Get Lavasoft Ad-ware and its companion Refupdate program and then run Ad-ware to remove the Xupiter spyware from your computer.
To: Formerly Brainwashed Democrat
Watch out for LOP.com. They really hide their junk well in your registry. I had a hell of a time removing the cancer.
I firmly believe they use that name because a "LOP" search of the registry produces way too large a result to do any good.
On the plus side, I taught myself a great deal about my computer's OS I never would have learned otherwise.
56
posted on
01/27/2003 12:39:55 PM PST
by
Spangler
To: Formerly Brainwashed Democrat
57
posted on
01/27/2003 12:42:37 PM PST
by
Spangler
To: Action-America
RE: Post#53, home for lunch,checked your post, thanks for the info.
58
posted on
01/27/2003 12:51:29 PM PST
by
FBD
To: Mr. K
I down loaded SpyBot see post #7, Sir Gawain.
Thanks!
59
posted on
01/27/2003 1:00:41 PM PST
by
FBD
To: Varmint Al
That's quite a list there. Thanks, I'll check through Internet tools/settings and see if any of those look familiar. I'm beginning to think humor sites are the worst ones for loading up cookies and popups.
When I clicked on the link at the FR thread, Xupitor came up as a search for the article, and I thought well, this is just linking me to it, and didn't give it another thought.
Click! Oh, well, live and learn! I'm glad there are so many helpful people here at FR. I've learned a lot today.
Back to work.
Thanks again
FBD
60
posted on
01/27/2003 1:13:47 PM PST
by
FBD
Navigation: use the links below to view more comments.
first previous 1-20, 21-40, 41-60, 61-80 ... 101 next last
Disclaimer:
Opinions posted on Free Republic are those of the individual
posters and do not necessarily represent the opinion of Free Republic or its
management. All materials posted herein are protected by copyright law and the
exemption for fair use of copyrighted works.
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson