World's Most Annoying IE Toolbar

nautical9 writes "Following the same devious footsteps of the infamous Bonzi Buddy, Gator, and Comet Cursor "enhancements", Xupiter now has their own self-installing toolbar for IE. There are many claims that if you leave your security preferences at their default level, it will install itself without your express permission. And once on your system, it's gracious enough to reset your homepage to xupiter.com, forward all your searches to their search engine, download and automatically launch applications (like gambling applets), and blocks all attempts to set these back to normal. Removing it isn't trivial either - it automatically checks for updates upon reboot, where it constantly changes the registry settings it uses, making the jobs of spyware removal programs like AdAware or Spybot Search & Destroy much harder. No word yet if it collects and forwards personal data."

no it won't

[rnd()]

No, if you leave your security preferences at their default level, things like this will not install. That is clearly FUD. Even if you have your security preferences a notch lower, it will still prompt you to confirm installation.

People get into the habbit of clicking "OK" whenever something pops up. Next thing they know, they have Gator and all sorts of junk installed.

Ouch..

[zeth]

One of my girlfriends computer has this toolbar, and it is a real pain working on that computer.

Popups can appear of nowhere, and other strange things occur, but the most disturbing thing is that it is causing other programs to crash! Okay, it's windows, but still.

It's evil!

This is old news

[realmolo]

Xupiter has been around for a while. And it's NOT hard to get rid off: http://www.xupiter.com/uninstall That's it. Way to overreact guys.

No it doesn't :)

[Fnagaton]

I've got default security settings and while it certainly displayed a few popups nothing else got installed. If however the user clicks 'OK' to things being installed without checking what they really do first then you get what you expect. :) Rule of thumb: Never install anything while browsing when it pops up and says "Hi install me for extra wizzy things!!!".

Was it smart to include the link?

[Vapor8]

Isn't it ironic that the article states all the bad things that can happen to your browser/computer if you go to their site and the toolbar is installed, yet the link is provided to it? And many of us, the curious lemmings that we are, will simply click on it... ;)

As far as I'm concerned, if you read the article and are dumb enough to go through the process of clicking the link and getting the software installed, maybe reading /. is a little over your head ;)

Seriously folks, if you're going to want to check this think out for yourself, please have enough 'smarts' to do so with a 'non-IE' browser...

Xupiter removal

[nate1138]

Yes, this is a tricky bugger to remove, unless you find the uninstall. Not documented, but thanks to some nice folks in the forum, here it is:

http://www.xupiter.com/uninstall/ [xupiter.com]

It's not a security "hole"...

[TheReckoning]

... it's having your ActiveX security at default permissions, which in itself is a boneheaded move by Microsoft.

Basically, default permissions say that any "signed" ActiveX control is OK to install without a prompt. So Xupiter just goes ahead and installs it.

People need to read up and learn how to use the (fairly powerful) security settings in IE6, and Microsoft needs to be chastized again for making default security too trusting.

But it's NOT a bug.

Simple tip for IE users

[Boss, Pointy Haired]

Here's an alternative way to use the Security Zones of Internet Explorer to protect you from crap like this.

First, set the "Trusted Sites" zone to the "MEDIUM" level.

THIS MAKES YOUR TRUSTED SITES ZONE THE SAME AS THE NORMAL INTERNET ZONE.

(People seem to flame this idea as a security risk without understanding that last bit)

Then, modify the "Internet Zone" and disable Active Scripting.

Finally, add all your favourite sites to the "Trusted Sites" zone.

You can now enjoy the full functionality of JavaScript etc. on your frequently visited sites including the usual protection of the Internet Zone.

Any site not in the Trusted Sites list cannot use JavasSript and so prevents pop-ups and other nasties such as self installing spy-ware.

Auto-Install

[Foxxz]

I did get this toolbar without clicking yes to anything. I wasn't on xupiter's website. I was browsing and after i was done i closed explorer. When i opened it back up late there was the tool bar. I still dont know where i got it. It took me a while to figure out who it belonged to and how to rid myself of it. I flamed away afterwards.

-Foxxz

Automatic downloads

[Lumpish Scholar]

On my Windows 98 SE box, I now browse with Phoenix [mozilla.org] almost all the time. I've discovered, though, that some browser downloads Internet Explorer asks me about, Phoenix installs automatically. (Phoenix seems a little too promiscuous about accepting Java, and doesn't remove .class files when it flushes the cache. Check the %WINDIR%/.jpi_cache/ directory structure.)

It's the kind of thing you might expect from a 0.5 release; unfortunately, it's not the kind of thing you should only expect from Microsoft.

Re:no it won't

[jkcity]

Not always there is many things that people can install on your computer through IE using bugs in active x controls and java script.

Detected by Norton Internet Security

[bfwebster]

My first clue about Xupiter was last night when my NIS alerted me that something called XupiterToolbar was trying to access the net. I blocked it, did a google search on Xupiter, found Spybot S&D, downloaded it, ran it, and found a whole slew of spyware, which I purged.

Time to recheck my security settings. ..bruce..

Re:*groan*

[dslpwr]

*duh* I DIDN'T install it. It happily installed itself, and no, I didn't just mindlessly click through everything that popped up on my screen. It hijacked IE, and I couldn't kill it until I installed Spybot.

Re:This is old news

[jbf]

RTFA: many people find the uninstaller doesn't work. And do you really trust that the uninstaller will remove any spyware they may leave behind? I mean, such a company must have incredibly high moral standards. They wouldn't do anything like leave behind spyware like Kazaa...

Re:Ouch..

[tijnbraun]

I found this in while reading their terms [xupiter.com].. (which is quite scary, actually) But anyhow maybe this will help: http://www.xupiter.com/uninstall.html [xupiter.com]

Complete uninstall?

[dachshund]

Xupiter has been around for a while. And it's NOT hard to get rid off: http://www.xupiter.com/uninstall That's it. Way to overreact guys.

I don't know about this week's version of the uninstaller, but previous versions were nice enough to leave behind big chunks of the program. Still running. Sort of the way a tick will leave its head behind if you yank it out with tweezers.

This is a pretty common and ugly tactic among spyware developers.

It's a monster

[rudog]

My wife was unfortunate enough to "click through" and victimize herself with this thing. I happened to notice 20-30 different sessions being generated every few minutes through our firewall and started tcpdump to find out what was happening.

After finding that it did indeed have my wife's credit card number/home address/phone number I asked her what she used it for; She said that she didn't know where it came from but that it was causing her laptop to crash about every ten minutes ever since it added itself to her IE toolbar.

I then spent about 3.5 hours hacking the WinME registry trying to peel this thing out of her laptop because it's 'uninstall' doesn't!

Wrong

[Tuxinatorium]

In earlier versions of IE for windows (like the ones that come bundled with windows 98 or ME and maybe 2000) there is a very well-known security flaw that allows malicious code on a website to make the computer download and execute arbitrary files without confirmation from the user. Most people are too stupid to download the updates to fix that vulnerability, so they should blame themselves. But that's how spamware trojans like Xupiter often spread.

And anyway, isn't that the digital equivalent of mugging and rape? I mean they either install the thing on your computer without permission and it totally fucks with everythig, or they trick you into installing it by outright lying about it and not telling you what a piece of shit spamware/spyware TROJAN HORSE it is. Couldn't they easily be sued for fraud and/or hacking people's computers?

Re:Misplaced blame

[Strike]

La la la la exploit [malware.com], la la la la description of exploit [malware.com], la la la la list of many other unpatched IE holes [pivx.com], some are over a year old. This one in particular is over 4 months old.

Check out their invasion (er...privacy) policy !

[peptidbond]

http://www.xupiter.com/privacy.html

Read just the first couple paragraphs to find out what they admit to collecting:

Your time zone
Sites you visit and for how long
How you enter and exit sites
Response rate to ads
Applications on your computer (to resolve SW conflicts...right).

License terms can be found at http://www.xupiter.com/terms.html. Frankly, I am scared to read them.

peptidbond

Personal Data collected

[Cheap Imitation]

From their Privacy Policy:

HOW DOES Xupiter WORK?

We provide you with advertisements that match your interests to make your Internet experience more satisfying. We determine your interests by collecting information about what sites you visit on the Web. For example if you visit a travel Web site, we may present an advertisement that promotes the sale of airline tickets. These special offers and advertisements may be displayed using various browser enhancements and pop-up windows on Web sites you visit.

Standard Web log information and computer settings such as your IP addresses, browser type and versions, screen resolution, time zone selected and the version numbers of some of the software installed on your computer.

Information about Web sites you visit -- this information includes the Web sites address (URL), the amount of time spent at a Web site, and how you entered and exited a particular Web site.

By using the Xupiter software application we are able to create a profile that is used to select and deliver special offers and advertisements that we think might be of interest to you. This profile is stored on Xupiter servers and contains the following information:

Your Xupiter ID which is a numeric identifier that is generated by the Xupiter software application.

A historical record of content and advertisements delivered by Xupiter, and the response rate associated with the content and advertisements that was delivered to you through the Xupiter software application.

I think that qualifies as close enough to collecting personal information...

Re:Ouch..

[Bob Ince]

See here for info and manual removal instructions:

http://www.doxdesk.com/parasite/Xupiter.html

Or use Spybot S'n'D to remove it - Ad-Aware 5 hasn't been updated and can't get rid of all variants of it properly.

This page:

http://www.doxdesk.com/parasite/

will test you for Xupiter and 60-odd other nasties, if you're using IE.

Re:no it won't

[Monofilament]

Just something I want to add. Maybe it was brain fart or something to that effect that day. But I DONOT blindly press yes on any of those popups... in fact I most likely will press no even though I'd like to say yes sometimes (in the case of things I'm actually trying to do).

This thing however did install itself automatically. I was going to a site.. do as I would normally do. I in fact never saw any questions popup. maybe I had a few popup windows that I closed quickly. Other than that nothing. Though next time I started up IE.. All the sudden I had this Xupiter thing. So tell me I'm lieing but that was my experience

On a Side note, What I did to uninstall was to first try and turn off the bar.. then uninstall from Apps/programs remove. Then I did an exhaustive search through my hard drive for any more xupiter programs.. deleted them. Then did a search in regedit to find anything that remotely looked like xupiter.. deleted those things.. and in some of them they had some stealthily named programs, of which I then searched for and deleted off my hard drive.. Took a bit of effort but got it off. Most normal people probably would have no idea how to get rid of this thing.

Re:Question

[Bob Ince]

> Anyone know which P2P one it is?

Grokster.

I don't believe it's in the current distribution, but there's an awful lot of other unsolicited commercial software in it. Grokster and iMesh are competing for the 'most offensively spyware-laden app' prize.

True and tried: no it won't

[hbackert]

I dared and tried. After visiting that web site I was prompted "Do you want to install and run..."

So it does ask you if you want to get it installed. Problem no. 1 is, that it's signed by Verisign. Problem no. 2 is of course sitting in front of the computer mindlessly pressing "OK" whenever it pops up.

But there is more: visit that web page, and get a hidden window which is kind of not visible, but it is there. Next visit: Bonzi pops under, telling me my computer is broadcasting an Internet Address.

About as obnoxious as possible. But it does not install itself (Win2k, IE 5.5SP2, not latest security patches, but not much behind).

Re:no it won't

[joshsisk]

I had this install itself on my computer and my security settings are at the default level. It was pretty easy to uninstall though. I just did a google search on "uninstall xupiter" and found a few sites with instructions. Actually, I think Spybot Search & Destroy took care of it... It really wasn't a big deal.

Re:Pretty easy fix

[JimDabell]

If you're using IE, you're running a piece of software *on your machine* which is advertising and providing the ability for a web page to basically screw your system up. If precisely this happens...well, you should have tried another browser. :-)

At any given time there are a dozen or so security holes in Internet Explorer. Right now there are 19 security holes [pivx.com] in the latest version of Internet Explorer, with all patches and service packs applied.

Xupiter is the Devil

[Syn404]

Wow. After my 15th or so run-in with Xupiter last week, I considered submitting this story to /. myself. Bah.

Anyhow, the best page for information and removals which I've found to date is at http://www.allentech.net/parasite/Xupiter.html

The removal info has worked every time, with the exception that on WinME it is usually possible to just drag the Xupiter folder into the Recycle Bin and delete it directly after a reboot.

Re:no it won't

[platypus]

Even aside from that, why the hell does IE do installations directly from a web page? That's beyond idiotic

So I guess you dislike mozilla too?

Hint: Google for xpinstall or go to mozdev and install a browser expansion - directroly from the web page.

Re:Pretty easy fix

[Dua]

Of course, even for those of us who *do* use different browsers, there are still programs which use IE as a browser automatically.

Trouble Is...

[E-Rock-23]

Check out this part of their license agreement:

(a) This Agreement constitutes the entire agreement between the parties concerning the subject matter hereof;(b) This Agreement and any dispute arising out of it shall be governed by the laws of Hungary; (c) Unless otherwise agreed in writing, all disputes relating to this Agreement (excepting any dispute relating to intellectual property rights) shall be subject to final and binding arbitration in the country of Hungary; (d) This Agreement shall not be governed by the United Nations Convention on Contracts for the International Sale of Goods; (e) If any provision in this Agreement should be held illegal or unenforceable by a court having jurisdiction, such provision shall be modified to the extent necessary to render it enforceable without losing its intent or severed from this Agreement if no such modification is possible, and other provisions of this Agreement shall remain in full force and effect; (f) A waiver by either party of any term or condition of this Agreement or any breach thereof, in any one instance, shall not waive such term or condition or any subsequent breach thereof; (g) The provisions of this Agreement that require or contemplate performance after the expiration or termination of this Agreement shall be enforceable notwithstanding said expiration or termination; (h) you may not assign or otherwise transfer by operation of law or otherwise this Agreement or any rights or obligations herein. (i) This Agreement shall be binding upon and shall inure to the benefit of the parties, their successors, and assigns; (j) Neither party shall be in default or be liable for any delay, failure in performance (excepting the obligation to pay), or interruption of service resulting directly or indirectly from any cause beyond its reasonable control.

Isn't that bloody well lovely?

Ah hah!

[Dannon]

So that's what this Xupiter thing is! I was visiting my family this weekend, and my sister asked me to fix her Win98 computer. IE was crashing every time she started it. I found this set of program files under this "Xupiter" directory and a bunch of load-on-startup registry items referencing them. Most of the files in this directory were locked by some running process, of course. Apparently, this Xupiter was not only self-installing but also Win98-unfriendly. And there was no uninstall program.

Restarted at DOS prompt to delete all the files. Regedit to remove every registry entry containing "Xupiter". After that, everything worked just fine, and I cranked up the security settings before I left.

McAfee's Xupiter Removal Instructions

[Wolfier]

They treat it as a virus.
I followed this on friend's computer and it works.

http://vil.nai.com/vil/content/v_99904.htm

Re:Ouch..

[interiot]

Some excerpts...

• Our software license requires that users browser start page be set to Xupiter.com in order to continue use of the Xupiter toolbar, from time to time we verify that users start page url is set to Xupiter.com, if it is not we reserve the right to alter it back.

It just gets worse and worse...

• Due to the ever-changing nature of software distributed on the Internet, Xupiter has included an auto update feature to ensure that you have the most recently released version of the Xupiter software. You acknowledge that Xupiter or parties appointed by Xupiter may from time to time provide programming fixes, updates and upgrades to you, including automatic updates to Xupiter, upgrades may include installation of third party applications, through automatic electronic dissemination and other means. You consent to such automatic updates and agree that the terms and conditions of this Agreement will apply to all such updates.

Basic protections ...

[tjwhaynes]

Hate to break it to you, but Mozilla does do automated installs from web pages. Just head on over to MozDev [mozdev.org] and see for yourself. Many projects, such as OptiMoz and Spellchecker, have automated install links right on the page.

Which only work if a) you actually have software installation enabled in your preferences, b) have write access to the location where mozilla is installed and c) will prompt you BEFORE it installs the software, giving the web server and the package being installed.

Automated installs are extremely useful - it's all a question of finding that balance between ease of use and ease of abuse.

Cheers,

Toby Haynes

Re:No it doesn't :)

[Col. Panic]

If you are running IE, click Tools, Internet Options, select the Content tab, click Publishers and make sure nothing is in the list. If you have anything there, that company can automatically install apps via your browser without asking.

The relevant registry keys...

[TooOldForThis]

IE Toolbars are simple self-registering COM objects. That means that they are controlled by registry entries. If one gets installed, its a simple matter of deleting the associated registry entries to keep it from loading. IE looks in the following key for toolbars which it should load:

HKEY_LOCAL_MACHINE
Software
Microsoft
Interne t Explorer
Toolbar
{Your Band Object's CLSID GUID}

Find its CLSID and remove it. Also remove the object's COM registry entry by removing the following key:

HKEY_CLASSES_ROOT
CLSID
{Your Band Object's CLSID GUID}

Be careful though - the menu, address, links, radio, etc... toolbars are also controlled this way. Make sure you're deleting the right entries!

Unless there's some other program running in the background that re-establishes these keys, there isn't any way that IE can load the toolbar if these entries are not present.

Kelly
lexteq.com (we've done a few toolbars ourselves)

The Computer Misuse Act is criminal law

[Anonymous Coward]

It's not a civil offence (like libel or breach of contract), it's a crime (like breaking & entering or theft). So you don't get sued by the victim if you break it; instead, you get prosecuted by the British government, and they certainly didn't agree to follow Hungarian law.

Besides,

(e) If any provision in this Agreement should be held illegal or unenforceable by a court having jurisdiction, such provision shall be modified to the extent necessary to render it enforceable without losing its intent or severed from this Agreement if no such modification is possible

and that's even if clickwrap licenses are binding in the UK (it hasn't been tested, but the prevailing opinion seems to be that it's unlikely).

Re:Thank God for Mozilla

[e40]

nytimes.com gets around the mozilla blocking of new windows, somehow. I've never seen another site that does.

Re:If it's going through all that trouble...

[Zerikai]

Scary license indeed... 5. Software Conflicts. Conflicts may occur with other software applications that may already be installed on your computer. The Xupiter software will report back to our servers what applications may be running on your system and will resolve these conflicts whenever possible. This will make our software more reliable and provide you with products and services that are compatible with your current system settings. Specially love that 'will report back to our servers what applications may be running on your system'. You still think they don't collect data?

Re:If it looks like a duck and quacks like a duck.

[bill_mcgonigle]

The article says that it is claimed that the user doesn't actually need to approve installation, in which case it's a virus. They then hedge to say that maybe you have to click "OK" on trickily-worded pop-up; if so, it's a trojan.

That's OK, I listened to a radio show about Slammer on the way in today. Their 'computer experts' explained that a virus is a program that destroys files on your hard drive, whereas a worm is one that replicates itself. They get paid pretty well for these appearances.

God, I need an iPod.

More information and removal instructions...

[timothyf]

...can be had here: http://www.doxdesk.com/parasite/Xupiter.html [doxdesk.com]

Re:Basic protections ...

[frleong]

Which only work if a) you actually have software installation enabled in your preferences, b) have write access to the location where mozilla is installed and c) will prompt you BEFORE it installs the software, giving the web server and the package being installed.

All of these are also available in IE. You can choose to disable downloading ANY ActiveX control (signed or not) and you'll be fine. That's what I do, after I installed the ActiveX controls I want: QuickTime and Flash.

The basic problem is that it is easy and tempting to press "Yes" to every dialog, whether it is Mozilla or IE.

Why don't you just uninstall it?

[GeekZilla]

You can to to their FAQ page which has a link to their uninstaller
'Course, it requires you to download and run another application from the same slimy people that gave you the spyware anyway. And yes, it IS spyware-Read their privacy policy-they freely admit it.

I cannot vouch for how well their uninstaller works because I was never infected (I use a Mac).

As an aside, I was just talking to my friend yesterday on the phone and he mumbled something like, "Xupiter? what the hell is this? This isn't my home page." (He uses a Gateway).

Re:Thank God for Mozilla

[DeadSea]

The bastard site in question: http://www.free-game-zone.com/ [free-game-zone.com] I just happened to stumble upon the site randomly. It appears to be a spam site with little to no content, but they still annoy me.

Uninstall

[SubtleNuance]

Click Here [xupiter.com] to uninstall the application.

why they cant put an entry in add/remove control is beyond me... oh, I forgot, this is a sypware/trojan/worm/virus, it dosnt like to be uninstalled.

Re:Automatic downloads

[scrytch]

> Phoenix seems a little too promiscuous about accepting Java, and doesn't remove .class files when it flushes the cache. Check the %WINDIR%/.jpi_cache/ directory structure. .jpi_cache is not the browser cache, and is controlled by the java plug-in control panel (no idea how you get to it on *nix). There was once a problem with the plugin caching too aggressively, but I'm told that's fixed in the 1.4 series.

Re:Pretty easy fix (OR TRY THIS)

[xo0m]

or try k-meleon (which, unlike mozilla/phoenix, is native to the OS)

kmeleon.sourceforge.net

Re:It's a monster

[liquidsin]

You could probably remove the modem from the 'games' account hardware profile. At least that way they'd have to go into the hardware profiles and re-add it, so it kills the "I'm too lazy to logout of this acct and log back in to surf the web". Just a thought...

it does send some personal info

[k3v0]

from the EULA: " 5. Software Conflicts. Conflicts may occur with other software applications that may already be installed on your computer. The Xupiter software will report back to our servers what applications may be running on your system and will resolve these conflicts whenever possible. This will make our software more reliable and provide you with products and services that are compatible with your current system settings. "

Re:THANKS

[Anonym0us Cow Herd]

If I really wanted to be evil I could write a self installing applet to default IE to the goatse.cx page everytime it opened upon a vistor visiting my site with an earlier browser.

You don't need an applet. Someone on slashdot has already done this. See this [slashdot.org] slashdot post, which, if you click the link in the posting, takes your browser on a carefully crafted roller coaster of 302 Object Moved across several different servers, eventually leading you to either the correct (advertised) New York Times article, or to goatse.cx if you are using IE. See my four replies under the post that explain how this was done. Note that the first of my replies was moderated as Troll because I was warning people about a goatse link.

A few questions answered:

[phorm]

From their "terms" and "privacy policy"

Terms

• The Xupiter software will report back to our servers what applications may be running on your system and will resolve these conflicts whenever possible
• Xupiter has included an auto update ... upgrades may include installation of third party applications
• To further enhance your media viewing experience, Xupiter reserves the right to run advertisements and promotions
• . Our software license requires that users browser start page be set to Xupiter.com

Privacy Policy

• Members agree to review this Privacy Policy from time to time for changes and updates

So yeah, basically the program will pop-up-ad slam you, give away your personal info, install crap software on your PC, and has the ability to change it's "terms" to allow it to do more behind your back.

Search Results on removal from Xupiter web site

[doublem]

How to remove Xupiter. [xupiter.com]

I like the fact that the Xupiter site can be used to find anti-Xupiter pages.

Re:My searches

[malarkey]

to their credit, Xupiter's search engine returns the best quality squirrel porn [xupiter.com] I've ever seen. If you're going to make a comment like that, at least include a link!!

Going after Xupiter

[Animats]

Let's see what we can find.

Xupiter claims to be based in Hungary. But it may not be.

First, Xupiter appears to be the same thing as Browserwise [browserwise.com]. The content of the two sites match, and you can download their malware from either site.

Whois for Browserwise yields:

• BROWSERWISE.COM
• 
  Administrative Contact: Inc., Browserwise, [e-mail]
  Browserwise, Inc
  15445 Ventura Blvd
  Sherman Oaks, California 91413
  United States
  [phone]
  Technical Contact: Inc., Browserwise, [e-mail]
  Browserwise, Inc
  15445 Ventura Blvd
  Sherman Oaks, California 90413
  United States
  [phone]
  Domain servers in listed order:
  NS1.CANDIDHOSTING.COM
  NS2.CANDIDHOSTING.COM

A traceroute on Xupiter isn't particularly helpful, but a traceroute on Browserwise leads to "amateurpornhouse.com", hosted on the same server. The server is thus virtual hosted by name, but if you try it by IP address [slashdot.org], you get Browserwise, so Browserwise is the main user of that server. "amateurpornouse" is thus either affiliated with Browserwise, or buys hosting from them.

Whois for "amateurpornhouse.com" yields:

• Registrant:
• 
  SC Enterprises
  P.O. Box 91114
  Henderson, NV 89009
  US
  [phone]
  
  Domain Name: AMATEURPORNHOUSE.COM
  
  Administrative Contact:
  Phucksum, Jeff [e-mail]
  P.O. Box 91114
  Henderson, NV 89009
  US
  [phone]
  

So we check Sexycouple's legal page [sexycouple.com], and find:

• Custodian of records for SC Enterprises: All records required to be maintained by 18 USC 2257 are kept by the custodian of records, Barry Levinson, 2810 South Rainbow Blvd. Las Vegas NV. 89146.

(Presumably this is not the well-known film director Barry Levinson.)

Looking up "SC Enterprises" in Las Vegas, we get

• SC Enterprises
• 
  134 Spinnaker Dr
  Henderson, NV 89015-5639
  Phone: [phone]
  

Also, DNS for Browserwise is provided by CandidHosting.com [candidhosting.com], next to the police station in Tampa, FL. They have to know who's behind this, so that's where to start with legal process.

That should be enough to get the lawyers started.

Re:no it won't

[macdaddy357]

1. Use Mozilla.
2.Pull down Edit.
3.Select preferences.
4.Select advanced.
5.Select Scripts&plugins.
6. there are check boxes under "allow scripts to," uncheck them.

How to quickly uninstall ANY IE toolbar

[Anonymous Coward]

You can easily uninstall ANY Internet Explorer toolbar using Advanced Uninstaller from Innovative Technologies.

It can also uninstall plugins and browser helper objects (BHOs).

You can download it from CNET [com.com].

Re:Wrong

[nick_davison]

Most people are too stupid to download the updates to fix that vulnerability, so they should blame themselves. But that's how spamware trojans like Xupiter often spread.

I run Windows Update at least once a month, closing off every IE security whole as Microsoft finds a fix for it... And Xupiter's still been a pain in the ass.

I honestly can't say for certain that it was never "agreed" to in the first place as I'm not the sole user of my home PC. What I do know is that, even after clearing the damn thing out of my system via Spybot S&D, it'll still turn up again in the middle of a session.

About the only lasting cure I've found (other than installing Linux *grins*) is to eradicate it and then set C:\Program Files\Xupiter to read only. Seeing as it always tries to install there, that seems to stop it.

I'm a senior web dev for a fairly major company. I keep my system patched. I have a good degree in Comp. Sci. I've used computers for 20+ years and worked on the web since '96. I'm employed to know way more about browser issues than most normal people. ...and still Xupiter's proving to be a pain in the ass. Yes, I can kill it (and have done so) but it's been a load of hassle. That's with all of my experience - should every PC user really have to have that level of knowledge before they can simply use the web?

Done!

[mark_space2001]

host xupiter.com
xupiter.com has address 63.236.32.50
mail is handled by mx1.xupiter.com

host mx1.xupiter.com
mx1.xupiter.com has address 63.236.50.196

whois -h whois.arin.net 63.236.32.50
Qwest Communications NET-QWEST-BLKS2 (NET-63-236-0-0-1)
63.236.0.0 - 63.239.255.255
Qwest Cybercenters QWEST-CYBERCENTER (NET-63-236-0-0-2)
63.236.0.0 - 63.236.127.255
Internext Media, Inc. QWEST-JSV-INTERNEXT1 (NET-63-236-32-0-1)
63.236.32.0 - 63.236.32.63

whois -h whois.arin.net 63.236.50.196
Qwest Communications NET-QWEST-BLKS2 (NET-63-236-0-0-1)
63.236.0.0 - 63.239.255.255
Qwest Cybercenters QWEST-CYBERCENTER (NET-63-236-0-0-2)
63.236.0.0 - 63.236.127.255
Snapshot Productions LLC. QWEST-JSV-SNPSHTPR (NET-63-236-50-192-1)
63.236.50.192 - 63.236.50.223

so I added 63.236.32.0 - 63.236.32.63 and 63.236.50.192 - 63.236.50.223
to my firewall block list, and they shalt never trouble me henceforth.

Done! Next!

Re:A few questions answered:

[phorm]

But they're "tailored" ads based on the sites you view.

So, when you go to goodpr0n.com it reads the site, and assume that you must be suffering from some type of relationship dysfunction. The next day: welcome to the viagara spammail list!

We won't even get into what happens if it combines results: you visit goodpr0n one day and a petcare site the next...

Re:no it won't

[chavo valdez]

Uhm, getright asks if you want to install gator. Just click the No button instead of blindly hitting enter. Getright is a good program and it actually warns you about the advertising and gator during the install. Grrrr. Time to reinstall windows again huh? Makes me regret not advancing my plan of Worldwide fucktard cleansing sooner than I have.

I think you're wrong...

[mark_space2001]

I have a previous post [slashdot.org] with xupiter.com's IP info, for those of you who want to block them.

Browserwise.com seems to be a totally different company, even the top level where the IP range is purchased from is different. Browserwise.com is hosted at the top level by Level 3 Communcations, while xupiter.com is hosted at the top level by Quest. I looked at both web sites (with Lynx! it's safe... ^_^) and the content does NOT seem to "match" to me.

Sorry but I think you just got carried away in your search and these two companies are not the same, or even related in anyway.

Ok, here's what I got.....

[Anonymous Coward]

I was infected with the toolbar last week, and had to do a little stalking to cool down...

Xupiter.com's netblock is registered to:

CustName: Internext Media, Inc.
Address: 15445 Ventura Blvd., Suite 318 Sherman Oaks CA 91403
Country: US
RegDate: 2002-05-09
Updated: 2002-05-09

NetRange: 63.236.32.0 - 63.236.32.63

Some other interesting things registered there are:

WHOIS whois.dotster.com cashclicks.com:

Registrant:
Erika Online Inc.
15445 Ventura Blvd Suite 318
Sherman Oaks, ca 91403
United States

WHOIS whois.dotster.com nudelink.com:

Registrant:
Universal Net
15445 Ventura Blvd Suite 318
sherman oaks, ca 91403
United States

Registrar: DOTSTER
Domain Name: ABCSEARCH.COM

Registrant:
Internext Media Corp.
P.O. Box 260542
encino, ca 91426
United States

ABCSEARCH.COM is run by a gentleman by the name of Daniel Yomtobian. Do a search and you'll be amazed by the number of lawsuits against the guy for domain squatting.

Sounds like a contender to me.

Use some decent browser proxy/filtering

[xQuarkDS9x]

I am rather suprised I don't see many people using proxies to deal with the "wild wild web" of spyware and malicious javascript/java/flash.

I have found a good combination is Proxomitron and JD5000 filterset. Both can be found here

http://home.satx.rr.com/jd5000/

It works with all browsers that support proxies (EG IE, Moz, Opera, Netscape) and best of all beside's ad blocking it does some rather cool features.

First filter I find handy is

Convert - Flash to Links.

Visit a site that has flash crap on it and it will say Flash removed/disabled. Next to it will be a option to turn on flash for the selected website only. This website URL will go into a blockfile named Allow - Flash.txt

Disable - Applet, Object, and Embed.

Now this is really damn handy as it will disable java applets, embedded crap and activeX objects, IE How Xupiter manages to get through.

If I need a site that has been verified by me that absolutely needs java or activex I can add it to the Allow - ActiveX blockfile.

THIS is basically how Proxomitron and JD5000 work's. It has a lot of features for security/ad blocking and more. Has also the usual filters to disable javascript or tame it down entirely, prevent nasty IE exploit's, etcetra.

To give everyone a idea at what exactly the filters the latest JD5000 update has, below are two pictures showing *ALL* the filters. First is the web page filters, second is the Browser Header filters. Filters that are in black are what I have turned on for day to day use.

Proxomitron's JD500 Web Filters (Jan 13th Release) [sympatico.ca]

Proxomitron's JD500 Browser Header Filters (Jan 13th Release) [sympatico.ca]

If configured right, Proxomitron+JD5000 can secure any browser a lot more, especially IE from all the nasties that rely on Activex to try and get through to your machine.