Heads Up! Someone is posting xupitor spyware link; Don't open it!

1/27/2003 | self

[FBD]

Heads up to Jim Rob and all.

I clicked on a link on a post here at FR couple of days ago, and accidentaly got xupitor.com spyware installed on my computer!

It looked harmless enough, and I thought I was going to a site to look at an article; but it changed my browser settings, tool bar, and added a bunch of "favorites", like online gaming sites, etc. Now, whenever I do a search, it directs me back to xupitor.com. This AM, I got some garbage, and a whole bunch of windows popping up behind my active window. My McCaffee Firewall starting screaming at me about a port attack...

Help from the savvy, as from what I can figure out so far, this is a hard program to get rid of. Heads up to all, and help requested.

[FBD]

RE post#56,57

thanks for the info! Although, as I stated in an earlier post, I'm half scared to click on any more hot links...

:^)

FBD

[Barset]

save

[Milwaukee_Guy]

Quickly scanned the previous posts and didn't see mention of the following xupiter goodie.

Go into your file manager (oops File Explorer) and, under tools, search for files modified or created in the last day.

Look -closely- for any .htm or .html file listed. I noticed, in my case, a graphic filename now had an .htm extension. Hmmm... This file is a -log- of all of your web activity and will even HOLD YOUR CREDIT CARD number if you had made a credit card purchase. You can read this file in any software that reads HTML. It's in plain english.

Follow all the previous advice given, but you are not done deleting xupiter files until you no longer see this daily .htm file being created by xupiter.

This borders on criminal conduct by this spyware company.

Thanks for nothing FCC....

[Tailback]

bump to read later

[FBD]

A friend told me today, that there is a class action lawsuit being started against Xupitor.com.

He didn't have any details, though.

Anyone know anything about it, and where to go to get on the list?

I want on it, I'm Pi$$ed!!!

[FBD]

lol! good one.

The cable company dolts told me to go to the xupitor web site, and ask for directions on unistalling their spyware. Ya, right. That's when I posted this. I got more help here at FR in a matter of minutes, then I did on hold w/ the cable comp.

I just got the IFCC site: - Internet Fraud Complaint Center: http://www1.ifccfbi.gov/index.asp

I am going to file a complaint.

[Clinging Bitterly]

Interesting thread.
I use ZoneAlarm and NAV, so I get alerted to most things that go on, and I'll check downloads for spyware if there's something out there that I find tempting.

I use Ad-Aware and like it, but I just tried this SpyBot that folks are plugging here, and it did uncover some registry entries that gave trusted status to some websites that are known to sometimes contain malware. Norton will usually catch malware as it moves into your cache, trusted status or not, but there still has been no intention on my part to give any website trusted site status - ever. I'd suspect those are from lesser known java exploits. I guess none of this protection stuff is perfect. One needs to be careful.

Funny, I don't have these problems on the Linux side of the system.

Dave in Eugene

[ZOOKER]

bump for later

[nutmeg]

Just got done downloading SpyBot Search and Destroy. Xupitor had loaded 61 files to my hard drive. Only one of them was visible. After reboot, looks like it's gone.

Wow... 61 files! I'd better check what's on my system. Thanks for the info.

[MeekOneGOP]

Whoo-Whee Deputy Dawg. Nasty. I was out all day yesterday and just now see your note.

I hope you were able to get this problem fixed. Were you?...

[Mobilemitter]

Thanks for the alert! That stinking xupitor stuff was driving me crazy. A most special thanks to Sir Gawain for the Spybot Search and Destroy link. It found what Ad-aware
software missed, about 16 registry changes, Yikes!!! It also found stuff I didn't know was there (like green things growing in the back of the refrig') that I was more than happy to get rid of.

[FairOpinion]

..are just a few of the big names that are known to contain spyware.
----

You seem to be very knowledgeable.
Is there some setting on your firewall that can prevent these from accessing the internet?
I use XP & Norton. I have it set so I have to give permission for each application to access the internet.
Also is there some setting that would notify you if your computer is downloading something?

Thanks a lot.

I started to get some "messages" from Realplayer, but I set my preferences to cancel that stuff. Would their spyware still be running, unbeknownst to me?

[Samurai_Jack]

Yeah, I caught that xupiter thing on my system. I had to run ad aware, then immediately shut down, boot to safe mode command prompt, physically delete the xupiter directory. Because the xupiter program keeps those dlls open so you cannot delete them.

Big pain in the ^$&$%& it was. Id like to get in on that class action suit.

[Samurai_Jack]

Manual removal

(from http://allentech.net/parasite/Xupiter.html )

Open the registry (from the Start menu, click Run and enter regedit) and find the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Delete the 'XupiterStartup' entry.

Open a DOS command prompt window (Start->Programs->Accessories) and enter the following commands to deregister the toolbar.

cd "%WinDir%\System"
regsvr32 /u "C:\Program Files\Xupiter\Updates\XupiterToolbar.dll"
regsvr32 /u "C:\Program Files\Xupiter\Updates\XTUpdate.dll"
regsvr32 /u "C:\Program Files\Xupiter\Updates\XTSearch.dll"

(If your Program Files folder is something other than 'C:\Program Files' - for example because you have installed on a different drive or you are using a non-English version of Windows, you will have to change the commands accordingly. You may also not need the last line, if you have an older version of the software without the XTSearch.dll file, so do not worry if this command gives an error.)

Restart the computer and you should be able to delete the Xupiter folder in Program Files. You can now restore your home page (Internet Options->General->Home page) and your search settings (Internet Options->Programs->Reset web settings). You can also delete the registry keys HKEY_CURRENT_USER\Software\Xupiter and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{A27CFCAE-9351-4D74-BFFC-21EB19693D8C} to clean up if you wish.

[trussell]

Place Marker

[Brad’s Gramma]

BTTT