Heads Up! Someone is posting xupitor spyware link; Don't open it!

1/27/2003 | self

[FBD]

I will find the thread I picked it up on, as I remember posting to it.

Just got done downloading SpyBot Search and Destroy.
Xupitor had loaded 61 files to my hard drive. Only one of them was visible. After reboot, looks like it's gone.

[Eva]

What kind of computer do you have and what system are you running. I had a problem with something my son put on my computer and I finally ran Restore and it's gone. It was so easy, after spending hours trying to find the darn thing and delete it.

[Eastbound]

FWIW: (According to my son)

Quote:

"To remove the Xupiter crap, you have to do a regedit and search and destroy on anything Xupiter.

Then, navigate to Windows\system32\Drivers\etc and open the Hosts file (the one with NO extension) with Notepad and change ALL the settings that refer to Xupiter and (I think, 3 others) to: 127.0.0.1 in place of the ip numbers that are there.

AdAware does NOT remove this Hijackware. In fact, since AdAware has NOT been updated, and will NOT be updated until the next version, it has been suggested to NOT use AdAware any longer, as it can remove some things that you actually need.

Just went thru this on a client's machine."

Endquote__________________________

[FBD]

Thanks for the link to Spy Bot! I just got done running it, and looks like I got rid of Xupitor.

What kind of creeps would design stuff like that?

Never mind, I know what kind. It was a rhetotical question...thanks again!

I've got a lot to learn. I think I won't be doing any more online banking, however. Should I cancel my accounts online, or at least reset them?


FRegards,
FBD

[TheJollyRoger]

AdAware removes the spyware junk from your system.

[FBD]

I've got a new machine with a Pentium 4, running Windows XP.
According to the gurus here, Windows isn't safe. So I'm going to check out Mozilla, etc.

See post #7 by Sir Gawain.

Spyware is embedded, I guess. Clicking restore doesn't get rid of it. After running the Spy Bot, it got rid of Xupitor.
It had 61 files on my hard drive, and only 1 was visible.
It's gone now.

[jude24]

I use it. Good program.

[FBD]

Thanks for the advice, and help.

[Rightly Biased]

bump to self for later read at home

[Eva]

You must not have gone back far enough with the Restore, because it got rid of all my problems.

I wouldn't worry to much about Windows. There are alot of anti-Microsoft people on FreeRepublic, but there are alot more who disagree. All the information about the latest problem said that if they had downloaded the Windows updates they would not have had a problem.

[Mr. K]

it wont let you delete it because it is probably running at the time.

You need to look at your 'startup' and autoexec and anything else that runs at re-boot.

[Varmint Al]

I have Norton Systemworks 2002 Pro running and just did a Memory Identification. These file came up and I can't identify what they do or where they are from:

C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SLLIGHTS.EXE

Can anyone tell me if these are bad? What would I lose if I were to dump them?

I also have been running Ad Aware for about 2 months and it seems to work very well keeping my cookies from loaded up from spyware.

Each time I get a new pop-up window, I right click on it and copy the URL up to the end of .com and add it to the list of restricted sites. The drill is:

In IE, click on tools. Click on the dropdown menu of Options. Then click the Security tab and then click on Restricted sites, then click on Sites. This brings up a slot "Add this Web site to the zone: where I paste the URL and then click Add. Here is the list of sites I have added to my restricted site list. For heavens sake don't click on any of these links. I put them in a format so they shouldn't be hot links.

Web sites that have either popped up or have generated bad cookies:
http://ad.doubleclick.net
http://m2.doubleclick.net
http://m.doubleclick.net
*.doubleclick.net
*.doubleclick.com
*.fastclick.net
*.doubleclick.com
*.fastclick.net
*.fastclick.com
http://ads.x10.com
*.x10.com
http://cserver.mii.instacontent.net
*.x10.com
http://cserver.mii.instacontent.net
*.instacontent.net
*.instacontent.com
http://ww2.weatherbug.com
*.weatherbug.com
http://ww2.weatherbug.com
*.weatherbug.com
http://www.sharewareonline.com
http://banners.valuead.com
http://banners.valuead.net
http://ads.yourfreedvds.com
http://banners.valuead.net
http://ads.yourfreedvds.com
http://ad.trafficmp.com
http://images.trafficmp.com
http://a248.g.akamaitech.net
http://www.netvisionsenterprises.com
http://a248.g.akamaitech.net
http://www.netvisionsenterprises.com
http://z1.adserver.com
http://www.angelfire.com
http://us.a1.yimg.com
http://www.image.ft.com
http://us.a1.yimg.com
http://www.image.ft.com
http://info.accumail.com
http://shopping.webmarket.com
http://amch.questionmarket.com
http://clickit.go2net.com
http://amch.questionmarket.com
http://clickit.go2net.com
servedby.advertising.com
http://servedby.advertising.com
http://bannerfarm.ace.advertising.com
servedby.advertising.net
http://bannerfarm.ace.advertising.com
servedby.advertising.net
*.servedby.advertising.*
servedby.advertising.us
*.servedby.advertising
http://img.mediaplex.com
*.servedby.advertising
http://img.mediaplex.com
http://view.atdmt.com
http://spd.atdmt.com
http://www.flowgo.com
http://www.linkfinding.com
http://www.flowgo.com
http://www.linkfinding.com
http://ads.fortunecity.com
http://www.fortunecity.com
http://a.tribalfusion.com
http://ad.smni.com
http://a.tribalfusion.com
http://ad.smni.com
http://static.smni.com
http://ads.hitcents.com
http://radiop1.xr1.net
http://ad.linksynergy.com
http://radiop1.xr1.net
http://ad.linksynergy.com
http://www.jit-software.com
http://www.hotels.net
http://www.perfiliate.com
http://www3.bannerspace.com
http://www.perfiliate.com
http://www3.bannerspace.com
http://global.msads.net
http://subs.timeinc.net
*.valueclick.net
*.valueclick.com
*.valueclick.net
*.valueclick.com
*.valueclick.org
*.valueclick.usa
*.valueclick.info
http://www.youclick2earn.com
*.valueclick.info
http://www.youclick2earn.com
http://63.246.3.5
http://209.164.32.120
http://208.253.92.54

Some of these might be redundant, but this list is working. Very seldom does Ad Aware find any new offending cookies now.

[Action-America]

I agree about Ad-Aware (that's a link to the latest retail version - older versions at download.com).  It's a great product.  I run it on all of my PC's once a month.  My Norton Firewall settings block most such spyware and I don't install any software that I am not already pretty sure about, so I have never found any spyware on any of my systems.  On the other hand, Ad-Aware has found and eliminated many spyware apps on machines belonging to my clients.

Before installing a program that you aren't sure of, go to SpyChecker or Tom-Cat.com Spyware List and search for the name of the product that you are going to install.  You will be surprised at some of the names on the list.  Notice that Aureate SpamKiller is on the list.  Use iHateSpam instead.  Also, CuteFTP is confirmed as containing spyware.  Use WS_FTP instead.  And it's not just small names either.  Windows Media Player 7 and 8 (version 9 is under investigation), Windows XP Search Assistant, Lexmark Print drivers installation, Netscape 6 through 7 (only logs use of search button) and RealPlayer 7 are just a few of the big names that are known to contain spyware.

Good Luck.

 

[Action-America]

I forgot to ping you on post 53. There are several good links there.

[goldstategop]

Get Lavasoft Ad-ware and its companion Refupdate program and then run Ad-ware to remove the Xupiter spyware from your computer.

[Spangler]

Watch out for LOP.com. They really hide their junk well in your registry. I had a hell of a time removing the cancer.

I firmly believe they use that name because a "LOP" search of the registry produces way too large a result to do any good.

On the plus side, I taught myself a great deal about my computer's OS I never would have learned otherwise.

[Spangler]

A warning about Gator spyware

[FBD]

RE: Post#53, home for lunch,checked your post, thanks for the info.

[FBD]

I down loaded SpyBot see post #7, Sir Gawain.
Thanks!

[FBD]

That's quite a list there. Thanks, I'll check through Internet tools/settings and see if any of those look familiar. I'm beginning to think humor sites are the worst ones for loading up cookies and popups.

When I clicked on the link at the FR thread, Xupitor came up as a search for the article, and I thought well, this is just linking me to it, and didn't give it another thought.


Click! Oh, well, live and learn! I'm glad there are so many helpful people here at FR. I've learned a lot today.

Back to work.

Thanks again
FBD