• Xupiter (IE 6 Sp1)

    Home » Forums » AskWoody support » Questions: Browsers and desktop software » Internet Explorer and Edge » Xupiter (IE 6 Sp1)

    Author
    Topic
    WSgottlieb
    AskWoody Lounger
    December 3, 2002 at 11:06 pm #380248

    I recently had quite a surprise. I was “xuped” by Xupiter. It hijacked my browser. I was able to completely remove it using Spybot Search and Destroy. Has anyone had the same experience. I would like to know what I should do to prevent it from occurring again. My IE secrurity settings are set at the default. I also blocked http://www.xupiter.com from my browser. Any other advice? Thanks

    Reply | Quote
    Viewing 2 reply threads
    Author
    Replies
    • WSBruce K
      AskWoody Lounger
      December 4, 2002 at 5:58 am #636170

      Don’t be surprised if it continues to happen again. There exists a whole new breed of downloads and hijacks that only require you to mouse over them. You can supress the automatic occurrences of this by setting your Security settings to at least medium and either disabling or prompting your various custom settings in the ActiveX controls, java and scripting to suit your needs.

      Reply | Quote
      • WSgottlieb
        AskWoody Lounger
        December 4, 2002 at 6:41 pm #636355

        Thank you both for your suggestions, especially the articles about this. What a pain! Too bad these programmers can’t put their talents to use for the good of all.

        Reply | Quote
      • WSd_rasley
        AskWoody Lounger
        December 5, 2002 at 12:41 pm #636529

        Do you know if these hijackers rely on the ‘OnMouseOver=’ command? If so, Proxomitron includes a filter that can deactivate mouseover commands, replacing the command with ‘OnPheasantOver=’ … a little on the silly side perhaps, but it stips mouseovers in their tracks.

        Reply | Quote
        • WSBruce K
          AskWoody Lounger
          December 5, 2002 at 2:03 pm #636549

          David, I do not know. I have been trying to find exactly from where Xupiter is executed so I can view the code. It is quite surreptitious and I always happen to have multiple instances of IE open when it downloads. It seems even more aggressive now as I have acquired it without prompts and have been sleuthing to find the offending page. If I catch it I will post back.

          Reply | Quote
          • WSHoward Kaikow
            AskWoody Lounger
            December 5, 2002 at 7:02 pm #636692

            Bruce–
            Xupiter’s web page came up–possibly it was linked to something– didn’t think much about it and some time later, Paint Shop Pro trialware appeared downloaded, but I hadn’t gone to Jasc to download it. I looked for it with Ad Aware, and didn’t find it–searched out the file and thought I had deleted it, then looked in the Registry and found it at:

            HKEY_CURRENT_USER>Softwear>Xupiter

            defrag

            Reply | Quote
    • WSR2
      AskWoody Lounger
      December 4, 2002 at 2:11 pm #636287

      I agree with Bruce. If you want stop this from happening, you are going to have to limit the “active content” in your Internet zone. There is always a price for security — ever lock yourself out of your car?

      Well, if you want your computer secure from these cretins, you’re going to have to lock it up tighter. It is your choice.

      Here is some reading:

      Browser Hijacking
      Homepage Hijackers
      Adware, Spyware and other unwanted “malware” – and how to remove them

      Reply | Quote
      • WSVBNerd
        AskWoody Lounger
        December 4, 2002 at 2:37 pm #636292

        I’ve pretty much given up on Swiss cheese IE and switched to Mozilla. The only issue I’ve run into with Mozilla is downloading .RAR files. It’s probably some setting that I need to tweak.

        Reply | Quote
      • WSgottlieb
        AskWoody Lounger
        December 4, 2002 at 6:41 pm #636354

        Thank you both for your suggestions, especially the articles about this. What a pain! Too bad these programmers can’t put their talents to use for the good of all.

        Reply | Quote
    • WSBruce K
      AskWoody Lounger
      December 5, 2002 at 2:08 pm #636550

      I would recommend double checking your Program files for Xupiter .dll files that can remain despite Spybot’s efforts. Also, I would search your registry and remove all instances of Xupiter. When you do this, watch carefully for names with X immediately before and after those entries as they are Xupiter entries as well and need be deleted. As always, perform a registry back up before tooling around in the event of a muck up.

      Reply | Quote
      • WSgottlieb
        AskWoody Lounger
        December 5, 2002 at 5:30 pm #636669

        Thanks for your advice. There were still a few instances where I found xupiter and deleted them from the registry.

        Reply | Quote
      • WSgottlieb
        AskWoody Lounger
        December 5, 2002 at 7:08 pm #636694

        I also installed “Browser Hijack Browser Blaster” from one of the websites mentioned for more information. I wish I could remember which one! Sorry. Its supposed to monitor the use of Active X and java scripts. IF you are interested, I could send you the downloaded file.

        Reply | Quote
        • WSHoward Kaikow
          AskWoody Lounger
          December 6, 2002 at 1:47 am #636775

          Here are some sites–looks interesting Gottlieb. Thanks for the offer.

          Wilder Security
          Browser Hijack Blaster Released Spam Cop List

          There are active suits in multiple jurisdictions against a number of these–including one against the purple chimp Bonzi Class Action Filed Against FUI Bonzi Software demanding $500 for each victim.

          defrag

          Reply | Quote
          • WSgottlieb
            AskWoody Lounger
            December 6, 2002 at 9:07 pm #636953

            Here’s an interesting development. I have Browser Hijacker Blaster installed and running. Twice in the last two days while not using IE, an alert came up stating that the home page was changed from http://www.excite.com to [nothing]. I try to change it back and it keeps changing back to nothing. If I check the home page under “General Internet Options” there are six ?????? in the box. The only way that I can get it to stay, is to reboot the computer. I also got an alert that a new BHO was detected from Adobe. I ran both adaware and spybot and nothing was picked up. Any ideas?

            Reply | Quote
      • WSgottlieb
        AskWoody Lounger
        December 7, 2002 at 11:56 pm #637090

        Here’s an interesting development. I have Browser Hijacker Blaster installed and running. Twice in the last two days while not using IE, an alert came up stating that the home page was changed from http://www.excite.com to [nothing]. I try to change it back and it keeps changing back to nothing. If I check the home page under “General Internet Options” there are six ?????? in the box. The only way that I can get it to stay at my home page, is to reboot the computer. I also got an alert that a new BHO was detected from Adobe. I ran both adaware and spybot and nothing was picked up. I have XP firewall installed and tested at some testing sites and the computer is secure…all ports are closed and my IP is not pingable. This morning (I leave the computer on all night) I checked the computer and Browser Hijacker had an alert screen up telling me that the home page was changed again. I uninstalled Browser Hijacker, and I haven’t had this problem all day. Any ideas?

        Reply | Quote
        • WSBruce K
          AskWoody Lounger
          December 8, 2002 at 1:22 am #637095

          Since your Browser Hijacker Blaster didn’t work (and I don’t trust it anyway) check out this homepage hijacker page and see if it or it’s links might help.

          Also, I failed to mention to remove a Xupiter ActiveX object in your Downloaded Program Files folder. Find that @#$!% and exterminate! It has the following ID: {A27CFCAE-9351-4D74-BFFC-21EB19693D8C}.

          Sorry I couldn’t be of more direct help sorry

          Reply | Quote
          • WSgottlieb
            AskWoody Lounger
            December 8, 2002 at 2:09 am #637098

            Thanks for the website. I did find a mention of the” start page as none” using “Hijackthis” software mentioned in a link on the site you suggested. I deleted it, so we’ll see what happens. I checked the Downloaded Program Files folder and that ID is not there. Thanks for all of your time and help.

            Reply | Quote
          • WSgottlieb
            AskWoody Lounger
            December 8, 2002 at 8:06 pm #637146

            I did end up on a forum with the address you sent and communicated with the author of Browser Hijacker Blaster who did admit af ter a while that his software might have caused the problem re: changing the home page to nothing! He said, “Wait until version 2 comes out.”!! Thanks again

            Reply | Quote
    Viewing 2 reply threads
    Reply To: Xupiter (IE 6 Sp1)

    You can use BBCodes to format your content.
    Your account can't use all available BBCodes, they will be stripped before saving.

    Your information:




DON'T MISS OUT!
Subscribe to the Free Newsletter
We promise not to spam you. Unsubscribe at any time.
Invalid email address

View the Forum

  • Recent Replies
  • My Replies
  • My Active Topics
  • New Posts in the Last day
  • Private Messages
  • Knowledge Base
  • How to use the Forums
  • All Forums

    • Recent Topics

    My Profile

    March 2025
    S M T W T F S
     1
    2345678
    9101112131415
    16171819202122
    23242526272829
    3031  

    Remembering Woody

     

    Want to Advertise in the free newsletter? How about a gift subscription in honor of a birthday? Send an email to sb@askwoody.com to ask how.

    Mastodon profile for DefConPatch
    Mastodon profile for AskWoody

     

    Home • About • FAQ • Posts & Privacy • Forums • My Account
    Register • Free Newsletter • Plus Membership • Gift Certificates • MS-DEFCON Alerts

    Copyright ©2004-2025 by AskWoody Tech LLC. All Rights Reserved.