Spyware, Browser Hijackings

[johnjoe]

I am a victim of browser hijacking. Today I was browsing the web when several annoying pop's were displayed. A specific one (porn) draw my attention not because of porn but because everytime i delete the cookie, url on the temp folder it kept coming back.

So this prompt to do additional search on my computer and I found an ugly Spyware name XUPITER. XUPITER consists of an internet explorer toolbar containing link buttons to one of Xupiter's search engines and a task run at Windows startup which downloads updates to the software and may launch pop-ups.

It also contain functionality to hijack your home page and search settings, and add Xupiter links to your bookmarks.

Then went to look for the folder and founf XUPITER folder under Program Files. Try to delete but it did not allow me to do it. Then decided to look further on the registry and this is what I did to remove this ugly thing:

Start Regedit

Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete the DWORD "XupiterStartup"
Run the following commands to unregister the various DLLs - note that some of the files may not exist on your computer.
cd c:\windows\system (or as appropriate for your computer)
regsvr32 /u "C:\Program Files\Xupiter\Updates\XupiterToolbar.dll" Repeat for xtupdate.dll, xtsearch.dll
regsvr32 /u "C:\Program Files\Browser\Updates\BrowserToolbar.dll"
Repeat for xtupdate.dll, xtsearch.dll
regsvr32 /u "C:\Program Files\Browser\Updates\BrowserToolbar.dll"
Repeat for bwupdate.dll and bwsearch.dll cexx.org reports that the following DLLs may need to be unregistered as follows:
regsvr32 /u "C:\Program Files\Sqwire\t.dll Repeat for u.dll and s.dll

Now my question:

What type of spyware is XUPITER? A worm? Trojan horse?

Can anyone give me links to site to prevent computer or browser hijackings?

Thanks for you help

[Spyrus]

you can also go here and use spybot search and destroy or you can use the official uninstall tool from xupiter which can be found

here



edit:
To answer your question:
Once you remove Xupiter from your system, make sure you never install the ActiveX control again.


In Internet Explorer, click Tools and choose Internet Options.
Go to the Security tab, click the Restricted Sites icon, and then the Sites button.
Under "Add this Web site to the zone:" type xupiter.com and click Add.
Add other sites that have ActiveX controls similar to Xupiter. We recommend Gator.com and Comet Cursor.
Click OK.

You won't be prompted to download ActiveX controls from these sites ever again.

the source for this can be found here



enjoy

[Maverick811]

An easier way to remove crapware (as I like to call it) like Xupiter is to use a program such as Ad-Aware, available from www.lavasoftusa.com - it does a great job of cleaning all this junk out of your system. I have gotten Xupiter twice now, as a matter of fact, I spent some time yesterday cleaning it out of my system again. Ad-Aware will clean out all kinds of this stuff, and should be run about once a week for a normal Internet user.

[Tedob1]

apparently your allowing Active-X controlls to run...without even prompting you for permission.

bad johnjoe!

go to your security setting and change this.

XUPITER is parasiteware.

http://allentech.net/parasite/Xupiter.html


et tu Maverick811

Spyrus doing it that way means evertime someone destroys your computer you stop allowing them...dont allow anyone to begin with...prompt before running at least

[tampabay420]

http://www.techtv.com/screensavers/t...369994,00.html

Twisted List: Top Five Ways to Detect Spyware


Learn how to download free software without giving up your privacy.
By Megan Morrone
Print Printer-friendly format
Email Email this story

SpywareSpyware is nasty. Spyware (also called "adware") is usually free software that comes bundled with little bits of code that sneak into your system to collect information about you and pass it on to another source without your knowledge or permission. Click here for a more detailed explanation.

Top five ways you can protect yourself from software spies

5. Spy Chaser

Spy Chaser is simply a database of known spyware. Before you download anything, type the name of the program in the window on top. If it is spyware, the program will show up in the right hand box. You also can scroll through the box on the left to see if you can find the program you are considering downloading there.

4. Spychecker

Spychecker is similar to Spy Chaser, but it has a larger database, which it claims to update daily. I also find this program a bit easier to use. With a click of the mouse, you can check to see if software is spyware, or report your experiences with invasive free software. If you don't want to download the program, simply bookmark the Spychecker website, and enter your query there.

3. SpywareInfo

If you're concerned about your online privacy, bookmark this resource right now. The SpywareInfo website will keep you updated on the latest news about suspicious software as well as government surveillance. You'll also get links to the newest downloads and software updates to help you get rid of any bad stuff already on your PC.

2. Silencer

If the program you are considering downloading shows up in a spyware database but you still really want it, you can use a program like Silencer that disables communication between your PC and the company collecting information. Note: If you use this program, you may be violating your EULA (end-user license agreement).

1. Ad-aware

I have yet to find a program that is more effective than Ad-aware at checking and removing spyware from your system. Ad-aware scans your memory, registry, and hard drive for invasive software and lets you easily remove offenders. You will be able to continue to use some programs after removing the spyware, but other programs will cease to work.

Let us know about any other good spyware catchers in the Talkback section below.

Posted January 29, 2002
Related Articles
· Twisted List: Top Five Free Demos
· Twisted List: Top Five Games Involving Frogs
· Twisted List: Top Five EBay Scores
· Twisted List: Five Things You Can Only Learn Online
· Twisted List Archive

Talkback Post your comment here >
· I think Ad-ware is a good progr... - Michael
· Keeping out the spyware can hel... - Professor Tracy
· Hi All! I've been using an a... - Randseed Bin
· Muah ah ah!! My friend Mike run... - Kim McBride
· I have one really good tool to ... - David Terry
· Ad-aware is the best on of all ... - Eric A.
· Ad-aware rocks! This is the be... - Sharon Haas
· I had trouble with Ad-Aware whe... - Jeff Piepenburg
· SpyBlocker is an excellent soft... - Ken Drogorub
· I have found Spycop to be effec... - Robert Mack
· Need more "Top 5" lists? How a... - John Hill
· I used Ad-aware and it totaly m... - Kris Mattfeld
· I have and use both Ad-Aware a... - Bill Roark
· I have been using Ad-Aware Plus... - Dudley Johnson

TechTV Spotlight

http://www.techtv.com/screensavers/t...369994,00.html

[UKnetSec]

Has anyone heard of companies developing spyware and alike for Linux?? Just that with the OS becoming more popular on the desktop I would have though that is their next target. I haven't actually managed to find any spyware removal tools for Linux, has anybody else?

[johnjoe]

Thanks for all of your replies. Though i found the solution on how to delete XUPITER, i really like to thank, Spyrus, Maverick811, Tedob1, and Tampabay420 for your tips. Tampabay420, i how Tampa Bay Bucs win this weekend.

[thehorse13]

One last thing to ice this thread. Ad-Aware has a component called Ref-Update. This is just a simple binary that you download and install just like you would Ad-Aware. You can get this from the lavasoft site. The Ref-Update tool downloads new spyware signatures so that you can be sure that Ad-Aware is cleaning out the most recent list of internet annoyances.

Good luck with cleansing your box.

[Maverick811]

Originally posted here by thehorse13
One last thing to ice this thread. Ad-Aware has a component called Ref-Update. This is just a simple binary that you download and install just like you would Ad-Aware. You can get this from the lavasoft site. The Ref-Update tool downloads new spyware signatures so that you can be sure that Ad-Aware is cleaning out the most recent list of internet annoyances.

Good luck with cleansing your box.

Good point - although Lavasoft hasn't updated their latest reference file in a few months, the latest release of the reference file is 042-24.09.2002. And if I am remembering right, Xupiter can only be removed by Ad-Aware with this latest ref file.

[TSeNg]

Originally posted here by UKnetSec
Has anyone heard of companies developing spyware and alike for Linux?? Just that with the OS becoming more popular on the desktop I would have though that is their next target. I haven't actually managed to find any spyware removal tools for Linux, has anybody else?

Im Assuming there are rouge crackers out there writing these kinds of things. But there is usually an anditote to every poison, why dont you try writing a spyware removal for linux, it migh be hard, but it would be pretty cool! :-) just a thought