World's Most Annoying IE Toolbar 950
nautical9 writes "Following the same devious footsteps of the infamous Bonzi Buddy, Gator, and Comet Cursor "enhancements", Xupiter now has their own self-installing toolbar for IE. There are many claims that if you leave your security preferences at their default level, it will install itself without your express permission. And once on your system, it's gracious enough to reset your homepage to xupiter.com, forward all your searches to their search engine, download and automatically launch applications (like gambling applets), and blocks all attempts to set these back to normal. Removing it isn't trivial either - it automatically checks for updates upon reboot, where it constantly changes the registry settings it uses, making the jobs of spyware removal programs like AdAware or Spybot Search & Destroy much harder. No word yet if it collects and forwards personal data."
My searches (Score:5, Funny)
Re:My searches (Score:3, Funny)
no it won't (Score:5, Informative)
People get into the habbit of clicking "OK" whenever something pops up. Next thing they know, they have Gator and all sorts of junk installed.
Re:no it won't (Score:5, Insightful)
I just went through 20 minutes of deleting it!
Re:no it won't (Score:5, Funny)
Viruses are known for leaving megabytes of junk in Exchange.
Wrong (Score:5, Informative)
And anyway, isn't that the digital equivalent of mugging and rape? I mean they either install the thing on your computer without permission and it totally fucks with everythig, or they trick you into installing it by outright lying about it and not telling you what a piece of shit spamware/spyware TROJAN HORSE it is. Couldn't they easily be sued for fraud and/or hacking people's computers?
Re:Wrong (Score:3, Insightful)
No, they should blame Microsoft. Like that article posted earlier about Slammer, the idea of blaming the victim for the crime is a little skewed. Microsoft needs to engineer better products. Because after all,
isn't that the digital equivalent of mugging and rape?
Er, a bit dramatic, but yeah, kind of. You can't (shouldn't?) call someone 'stupid' for getting mugged or raped.
Re:Wrong (Score:5, Funny)
Well, if someone was walking around the Internet, flaunting their IE all over the place, with their security settings half way down to their waist, then weren't they asking for it?
Come on, you know they wanted Xupiter. They wanted it!
Re:Wrong (Score:4, Insightful)
But let's compare that to reality.
1) Microsoft intentionally markets to consumers that they know are incapable of mildy difficult technical tasks.
2) Microsoft patches are incredibly perverse in their installation procedures, often break other things, and sometimes don't work at all.
3) The sheer volume of Microsoft exploits means that a person would be compelled to spend the great majority of their waking hours applying the damn things, just to keep their head above water.
4) Microsoft hides news of their vulnerabilities in the Labyrinth of their website to the point that a person would be compelled to check a large list of other security websites just to remain aware of what the dangers were.
5) Many of these exploits are the end result of bad coding practices, bad design philosophies and ill-concieved architectures, and not just obtuse, hard-to-recognize bugs that slip through *anyone's* quality control.
6) And while not exactly relevant to this discussion, if I ever see someone dressed up in one of those butterfly costumes, they are DEAD. Literally, I intend to murder them. I'm fairly confident that most juries won't ever convict.
So, taking all this into consideration, the metaphor would be more accurate if this person were drugged/brainwashed from birth, taught that it is only appropriate to be led around in chains 24/7 by strange men, was often sold to the highest bidder, beaten whenever she spoke up, was given no choices or significant decision-making privileges, and then woke up in the strange bed.
It might not be rape exactly, but something horrible did happen, and she is most certainly some type of victim. To ignore all the circumstances leading up to that event, and then claim "she never said No" is absurd beyond the pale.
Re:Wrong (Score:3, Redundant)
Microsoft has helped the situation by creating the automatic update service. It is a small app that runs every day (roughly the equivalent of code run by a cron job, but handled as a windows service) and checks to see if any security patches have been released. Depending on how you set it up, it can notify you, notify you + download the updates, or do all of the above AND install the updates.
Two things will make the kinds of exploits being discussed impossible:
1) Completely bug/exploit free code.
or
2) Widespread use of tools such as Automatic updates.
Redhat and Mandrake both have a service that emails you the latest bugfix/security information. This, combined with MandrakeUpdate and RedHat's equivalent tool, can help a sysadmin keep up with the latest patches with minimal effort. It also lowers the bar for the amount of expertise required to properly keep a system secure.
Re:Wrong (Score:3, Insightful)
The last time I tried to download a security update to a windows product, I was asked to:
1) Agree to new licensing terms
2) Download the ENTIRE update for office 2000 - tens of Meg.
It's not stupidity - it's the enormous hassle of downloading. The whole patch system Microsoft has put in place is just too screwed up to deal with.
Re:Wrong (Score:4, Informative)
I run Windows Update at least once a month, closing off every IE security whole as Microsoft finds a fix for it... And Xupiter's still been a pain in the ass.
I honestly can't say for certain that it was never "agreed" to in the first place as I'm not the sole user of my home PC. What I do know is that, even after clearing the damn thing out of my system via Spybot S&D, it'll still turn up again in the middle of a session.
About the only lasting cure I've found (other than installing Linux *grins*) is to eradicate it and then set C:\Program Files\Xupiter to read only. Seeing as it always tries to install there, that seems to stop it.
I'm a senior web dev for a fairly major company. I keep my system patched. I have a good degree in Comp. Sci. I've used computers for 20+ years and worked on the web since '96. I'm employed to know way more about browser issues than most normal people.
Re:Wrong (Score:5, Insightful)
Then those Slashdotters would be wrong. Federal law prohibits unauthorized access to a computer.
Granted, you could argue that running IE and not installing the tons of patches MS has slapped over many of its plethora of holes is "granting authorization" to the remote site, but I don't think a judge's sense of irony would go that far.
Re:Wrong (Score:5, Interesting)
This is why argument by analogy is so maligned here on Slashdot.
The analogy you refer to is most likely the distribution (rights?) of RIAA and/or MPAA sanctioned materials, including music files and movies, correct?
In order to download these, I do not need to violate any individual's privacy. Instead, I download (voluntarily) any number of freely available P2P applications and initiate transfers from people who have willingly configured their software packages to allow me access to a 'shared' portion of their own systems. These people populate this folder with files they have copied, downloaded, or created themselves. The source materials for these transfers were made available to the public by the aforementioned entities, so nobody had to violate their computer systems or physical locations to obtain the source.
There is no subterfuge involved, nor is there any involuntary transfer of otherwise private materials. (Vis, the files, e-mail, and information stored therein on my home PC(s)).
(Note that I am stating no position, pro or con, on the topic of P2P applications or their content, merely discussing your analogy. I don't want to open any further cans of worms).
IANAL either, but I do believe there is legal footing for such a case. The users' computers are made to operate in a mannar in which they were not prepared, or willing to have it operate. Everything from the homepage being changed to software that alters the overall behaviour of the system to software of unknown quantity that opens potential security holes in the system.
The other factor to consider is the costs associated with repairing the system which are quantifiable. For example, if I have to visit a company and purge six office workstations of this software, the company is looking at not only a lost afternoon's work, but also a bill from me for $60/hour for anywhere up to six full hours. That's assuming that a) there are only six infected machines, b) the software is not in any way self-replicating, b) the software is readily removed from the systems, and does not ressurect itself. The other thing I would have to do while on the premeses is update all Windows installations (Windows Update) and all virus software and definitions as preventitive measure, thereby bringing the potential time per workstation up to the full hour mark, if not greater (dial-up would require either a long download, or a return to a broadband connection and CD burner to download the updates manually).
Long story short, since there are quantifiable costs, lost productivity, and damages that can be attributed to software of this type, I do believe suit could be brought against the makers. Based on the installation methods, I do believe fraud charges could also be lain.
True and tried: no it won't (Score:3, Informative)
I dared and tried. After visiting that web site I was prompted "Do you want to install and run..."
So it does ask you if you want to get it installed. Problem no. 1 is, that it's signed by Verisign. Problem no. 2 is of course sitting in front of the computer mindlessly pressing "OK" whenever it pops up.
But there is more: visit that web page, and get a hidden window which is kind of not visible, but it is there. Next visit: Bonzi pops under, telling me my computer is broadcasting an Internet Address.
About as obnoxious as possible. But it does not install itself (Win2k, IE 5.5SP2, not latest security patches, but not much behind).
Re:no it won't (Score:3, Informative)
Re:no it won't (Score:5, Insightful)
Re:no it won't (Score:5, Interesting)
I've seen and removed this toolbar from atleast a hundred machines by now, and even had machines myself on which it's become installed, and yes, it does install without my express permission. It will install as a piggy-back to another application, it will install on launch of another application, and it doesn't inform the user in the slightest.
As for removing it, that's not terribly difficult in and of itself. Disable the toolbar in IE (View -> Toolbars -> Xupiter ... ), kill all running processes except for Explorer and Systray. Run regedit and search for 'Xupiter'. Remove all entries dedicated to the program, and the entries dedicated to the default homepage, search engine, etc. I merely change to http://www.msn.com/ and http://www.google.com/ respectively.
For the record - I've personally witnessed software being installed on a Windows machine in real time (Win2kSP3, IE6SP1, all patches applied), with no permission dialogs appearing, letalone agreed to. (I've been in this business far too long to blindly hit "Ok"). I got a full-screen movie attempting to download (wasn't going to happen over the 56k modem) with no 'quit' option available (I had to resort to the task manager; Alt-F4, Alt-Tab, Alt-Esc, Ctrl-Esc were not responding), several icons on my desktop, and shortcuts to applications in my startup folder. I don't know if there was any further damage, or whether I prevented further damage by disconnecting from the Internet before the payload could download, but it was enough to unsettle me and send me screaming back to Mozilla.
It not only can happen, it does happen, and it is most certainly not FUD. There is documentation of scripts/applets being downloaded and running from the "trusted" local zone which allows them pretty wide range of freedom over your system.
Just because most Microsoft bashing is zealotry doesn't make it all false.
Re:no it won't (Score:4, Insightful)
Let's see, we have the technically illiterate on one hand. These people fall prey *far* more to malicious remote-install links than they are benefitted by deliberately remote-installing software. Not benefit to IE's behavior there.
Then we have the technically ept, who are quite able to download, save, and run an installer if they really want to run it. No benefit to IE's behavior there.
Frankly, IE's behavior takes a position of extreme trust of the remote end, which is just plain *stupid* in today's world.
Re:no it won't (Score:3, Insightful)
Ultimately, the user should read any warning message that pops up, whether it's from IE, your anti-virus software, or from your OS.
Re:no it won't (Score:5, Interesting)
I'd argue that it is. First they have to see a (familiar) file-dialog box pop up. They aren't just hitting "OK" in a box -- they know that they are saving a file somewhere. Even novice users are generally pretty familiar with the file open/save dialog boxes. Second, they have to navigate to their desktop. to save the file. Then they have to click "save", switch to Explorer, and then double-click the icon. Again, double-clicking is a fairly familiar action, and people are aware that yes, they are openin something. So we have many steps, including familiar steps that will tend to clue even a novice Windows user, rather than a single "OK".
Ultimately, the user should read any warning message that pops up, whether it's from IE, your anti-virus software, or from your OS.
Windows users are *innundated* by dialog boxes. Every time they delete a file. A whole slew of them when they install software. Four hours ago, my roommate was using a TV-viewing program that brough up a message box telling him that he'd "enabled option foo" each time he clicked a checkbox in the prefs dialog.
In addition, Javascript can bring up message boxes (idiotically enough, this is enabled by default by MS). So most users (*especially* Internet Explorer users) run into a ton of message boxes while browsing. Yes, perhaps they should go through each dialog box and examine it, but that's very time-consuming. If you read through Apple's Human Interface Guidelines, you'll notice that the *vast* majority of rules for menus and modal dialogs are designed around one single goal -- letting the user *not* have to examine each dialog box once they're familiar with it or boxes in similar software. The point is that Windows users are sick and tired of dialog boxes, and *do not read them* in detail. And they shouldn't *have* to be screwed over if they skim or misread a box when simply web browsing. A Javascript should not be able to take malicious, destructive action just because someone clicked "OK" in one of a series of dialogs that a Javascript popped up. To set up IE to operate this was was irresponsible in the extreme by Microsoft.
Re:no it won't (Score:3, Interesting)
Idiotically enough, this is enabled by default by just about every browser for every OS.
A Javascript should not be able to take malicious, destructive action just because someone clicked "OK" in one of a series of dialogs that a Javascript popped up.
It can't. You're mistaking "Install on Demand" (bad thing) for JavaScript alert()s.
Re:no it won't (Score:5, Informative)
So I guess you dislike mozilla too?
Hint: Google for xpinstall or go to mozdev and install a browser expansion - directroly from the web page.
Re:no it won't (Score:4, Informative)
2.Pull down Edit.
3.Select preferences.
4.Select advanced.
5.Select Scripts&plugins.
6. there are check boxes under "allow scripts to," uncheck them.
THANKS (Score:5, Funny)
Re:THANKS (Score:3, Funny)
Re:THANKS (Score:5, Informative)
You don't need an applet. Someone on slashdot has already done this. See this [slashdot.org] slashdot post, which, if you click the link in the posting, takes your browser on a carefully crafted roller coaster of 302 Object Moved across several different servers, eventually leading you to either the correct (advertised) New York Times article, or to goatse.cx if you are using IE. See my four replies under the post that explain how this was done. Note that the first of my replies was moderated as Troll because I was warning people about a goatse link.
You asked for it! (Score:4, Funny)
REAL MEN parse the raw html in their heads and just imagine what the pictures are from the tags.
Wimp.
Re:You asked for it! (Score:5, Funny)
Oh GOD, now it's installed there too!
If it's going through all that trouble... (Score:5, Insightful)
Oh yea... as if they're going to go through all of that trouble and deception and not collect and forward personal data.
Right.
-S
Pretty easy fix (Score:5, Insightful)
If you're using IE, you're running a piece of software *on your machine* which is advertising and providing the ability for a web page to basically screw your system up. If precisely this happens...well, you should have tried another browser.
(If you don't like the Moz suite approach, try Phoenix)
Re:Pretty easy fix (Score:5, Informative)
At any given time there are a dozen or so security holes in Internet Explorer. Right now there are 19 security holes [pivx.com] in the latest version of Internet Explorer, with all patches and service packs applied.
Re:Pretty easy fix (Score:3, Insightful)
Basic protections ... (Score:5, Informative)
Hate to break it to you, but Mozilla does do automated installs from web pages. Just head on over to MozDev [mozdev.org] and see for yourself. Many projects, such as OptiMoz and Spellchecker, have automated install links right on the page.
Which only work if a) you actually have software installation enabled in your preferences, b) have write access to the location where mozilla is installed and c) will prompt you BEFORE it installs the software, giving the web server and the package being installed.
Automated installs are extremely useful - it's all a question of finding that balance between ease of use and ease of abuse.
Cheers,
Toby Haynes
Re:Basic protections ... (Score:5, Informative)
The basic problem is that it is easy and tempting to press "Yes" to every dialog, whether it is Mozilla or IE.
Help! (Score:5, Funny)
No it doesn't :) (Score:5, Informative)
Re:No it doesn't :) (Score:3, Interesting)
There is some mechanism where this crap gets installed and it might not be via Internet Explorer but personally can't rule it out. When I moved to Mozilla I never had this problem any more.
Re:No it doesn't :) (Score:5, Informative)
Was it smart to include the link? (Score:5, Informative)
As far as I'm concerned, if you read the article and are dumb enough to go through the process of clicking the link and getting the software installed, maybe reading
Seriously folks, if you're going to want to check this think out for yourself, please have enough 'smarts' to do so with a 'non-IE' browser...
IE (Score:3, Funny)
Internet Explorer
Box of chocolates
Question (Score:4, Interesting)
Xupiter is also being bundled along with at least one peer-to-peer file sharing program
Anyone know which P2P one it is?
(Mainly so I can avoid it.)
Re:Question (Score:5, Informative)
Grokster.
I don't believe it's in the current distribution, but there's an awful lot of other unsolicited commercial software in it. Grokster and iMesh are competing for the 'most offensively spyware-laden app' prize.
If it looks like a duck and quacks like a duck... (Score:5, Interesting)
If it looks like a duck and quacks like a duck then it's usually pretty safe to say that it's a duck. In this case all of these enhancements sound like viruses to me, or at least a derivitave of a virus. Where viruses had to be cleverly coded in order to be as small as possible and avoid detection by a skilled hacker these new pieces of code are large and increasingly rely on being able to remove software that would remove it.
If you modify my system without me requesting it then you've installed a virus on my system. I should be able to call the FBI computer crimes division and get proceedings underway that result in you getting some nice free government accomodations.
Re:If it looks like a duck and quacks like a duck. (Score:5, Insightful)
I agree. But it's interesting to note that if this software had been written by an individual, rather than a corporation, the FBI would already be looking for the culprit. For some reason, corporate misbehavior is below the FBI's radar.
From the article:
It's a browser toolbar that some swear is doing "drive-by downloads" -- installing itself without users' permission -- then taking over their systems and making it impossible to uninstall.
Technically, this is a virus. And IIRC, "unauthorized alteration of a computer system" is punishable by 5 years in prison and up to a $250,000 fine.
Re:If it looks like a duck and quacks like a duck. (Score:5, Interesting)
Hm. Sounds suspiciously like a trojan horse to me. Doesn't anyone know the difference anymore?
We'll show them... (Score:4, Interesting)
Also, site said to report any problems to help@xupiter.com. How many requests do you think they'll get about the toolbard?
Man alive! (Score:3, Funny)
***//MESSAGE TERMINATED//INSERTING REPLACEMENT//***
XUPITER IS GREAT! EVERYONE NEEDS XUPITER! IT CAN TYPE FOR YOU! WHY DON'T YOU INSTALL XUPITER [xupiter.com] NOW?
Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter Xupiter
Legal Action? (Score:3, Interesting)
It's interesting, if a teenage computer wiz went on someones website and changed the configuration and wrote lets say "riaa is ass" they'd be charged, why is this any different? If I hack (hypothetically) into the Xupiters site and alter it, am I released from any legal liability because they did it to my machine first? Sort of like a cyber self-defence?
What? No Mac version?? (Score:5, Funny)
This just in (Score:4, Funny)
There is also no word in yet if it will blast your brain with secret radio waves that will make you submit to secret commands from the government but it's a good idea to always wear your tin-foil hat anyways.
Sheesh...
For a while now (Score:5, Insightful)
The problem with these damn things is that you never quite know how they got onto your machine. I'm always very careful about what I install, and which dialog boxes I say "OK" to, but there's always the possibility that I accidentally let something slip through. I suppose that's why people aren't 100% sure if it can install itself right from IE without confirmation.
I'm getting increasingly sick of using IE, but I'm constantly running across sites that Mozilla just can't handle properly (or swiftly). And yes, I've cranked up the security level, though god knows why there exists any level of "security" that would allow unconfirmed installs.
A Temporary Fix... (Score:5, Interesting)
I was fixing somebody's computer that had this toolbar installed and it would crash IE every time you opened IE (Or tried browsing the web via windows explorer). But once I Disabled 3rd Party Browser Extensions, it worked fine...
Simple tip for IE users (Score:5, Informative)
First, set the "Trusted Sites" zone to the "MEDIUM" level.
THIS MAKES YOUR TRUSTED SITES ZONE THE SAME AS THE NORMAL INTERNET ZONE.
(People seem to flame this idea as a security risk without understanding that last bit)
Then, modify the "Internet Zone" and disable Active Scripting.
Finally, add all your favourite sites to the "Trusted Sites" zone.
You can now enjoy the full functionality of JavaScript etc. on your frequently visited sites including the usual protection of the Internet Zone.
Any site not in the Trusted Sites list cannot use JavasSript and so prevents pop-ups and other nasties such as self installing spy-ware.
Auto-Install (Score:5, Informative)
-Foxxz
Automatic downloads (Score:5, Informative)
It's the kind of thing you might expect from a 0.5 release; unfortunately, it's not the kind of thing you should only expect from Microsoft.
Detected by Norton Internet Security (Score:4, Informative)
Time to recheck my security settings. ..bruce..
Self-installing programs are illegal. (Score:5, Interesting)
Re:Self-installing programs are illegal. (Score:4, Interesting)
terrorists! (Score:3, Funny)
(maybe with claims like that we can convince the goverment to go start witch hunts that will go after all the irritating things like that one)
It's a monster (Score:5, Informative)
After finding that it did indeed have my wife's credit card number/home address/phone number I asked her what she used it for; She said that she didn't know where it came from but that it was causing her laptop to crash about every ten minutes ever since it added itself to her IE toolbar.
I then spent about 3.5 hours hacking the WinME registry trying to peel this thing out of her laptop because it's 'uninstall' doesn't!
Re:It's a monster (Score:5, Interesting)
This is my biggest nightmare at home. I have XP Home Edition - so I figured I finally have a solution to this problem - just make everyone else who uses the system a "limited user" - they finally figured out what unix did 20 years ago.
Nope - turns out half the software out there doesn't run without administrator access. And it isn't just lousy shareware junk either - try running MS Flight Simulator 2002 Professional as a "limited user". So now I need an admin account for the kids to play games - I set up the ground rules as being "don't web browse when logged into the games account", but of course there is no way to enforce that. I have Mozilla installed, so that at least is a start, but IE is still out there, and even with mozilla a computer-illeterate user can download a hostile
My only solution is to backup reasonably often. Still, I don't backup everything - just data - since it would use gobs of media. So if somebody hoses my system I'll be reinstalling everything - and that is quite a bit of junk - hundreds of megabytes of it having been downloaded from the web (redownloading over a 26k modem link isn't fun either).
If MS would at least code their software to not require admin access I'd be happy... Then again, maybe I should find an old PIII somewhere for the kids to play games on - of course it wouldn't have the GeForce III Ti accellerated graphics...
Re:It's a monster (Score:5, Informative)
Prevention tactic (Score:5, Insightful)
attrib +r "C:\Program Files\Xupiter"
Re:Prevention tactic (Score:3, Insightful)
I followed this on friend's computer and it works.
http://vil.nai.com/vil/content/v_99904.htm
Re:Prevention tactic (Score:4, Insightful)
This is not true (Score:4, Interesting)
AdAware found it, and tried to removed it, but not everything was deleted, as there were still at least 1 or 2 DLLs that were registered and running, that couldn't be deleted. Couldn't find the processes, either. Had to use regserv to get rid of them. This company is about the lowest of the low in my book.
To always trust content from 'x' Click Here O (Score:3, Funny)
I have never checked 'always trust' and have wished for a 'Never trust, key their car, and don't ask me again' checkbox for a long, long time.
Especially after the "Microsoft is no longer a 'Trusted' party fiasco of last year.
If you can't trust Bill, who can you trust?
Thanks for listening, Bonzi Buddy. You're my only friend.
Xupiter is the Devil (Score:4, Informative)
Anyhow, the best page for information and removals which I've found to date is at http://www.allentech.net/parasite/Xupiter.html
The removal info has worked every time, with the exception that on WinME it is usually possible to just drag the Xupiter folder into the Recycle Bin and delete it directly after a reboot.
This will wreak havoc with end users.. (Score:5, Insightful)
I find it hard to believe that it would install itself with everything set to default on a properly updated copy of IE 6.0 SP1. It's much more likely that Xupiter is just betting on people clicking yes to the security warning prompt.
Taken from Xupiter's end user agreement [xupiter.com]: To further enhance your media viewing experience, Xupiter reserves the right to run advertisements and promotions based on URLs and/or search terms users enter when navigating the Internet. Other enhancements and to allow access, users web browser, start page, search page, auto search option, bookmarks and default error page will be changed, along with the Xupiter accessory toolbar added to the web browser. Active desktop panel will be installed on the users desktop which will enable active desktops on the system for special promotions. Our software license requires that users browser start page be set to Xupiter.com in order to continue use of the Xupiter toolbar, from time to time we verify that users start page url is set to Xupiter.com, if it is not we reserve the right to alter it back.
Great - it enables active desktop too; what fun!
Be careful... (Score:3, Funny)
FUI Dialogs? (Score:5, Interesting)
Probably because the popup is a fake user interface dialog. How in God's name does even a novice user inadvertently grant permission for a software install when their original intent was to close the window? Or is it common knowledge these days that the X in the top right corner of a dialog box is synonymous with the OK button.
Bonzi is being sued [slashdot.org] for this, and these scumbags deserve the same.
Ah hah! (Score:5, Informative)
Restarted at DOS prompt to delete all the files. Regedit to remove every registry entry containing "Xupiter". After that, everything worked just fine, and I cranked up the security settings before I left.
This isn't the only one... (Score:5, Insightful)
The funniest part: this is the second time she's brought her computer in with these toolbars. After we had removed them the first time, we explicitly told her NOT to download web enhancements and toolbars...here she was again.
I have owned a computer since 1990, and since 1990, I have yet to use a passive virus scanner. Since 1990, I have yet to get a virus...this girl has had several in the past month, and she DOES have a virus scanner running.
Less clicking, more reading.
There are lot of people out there with this (Score:3, Interesting)
1) IE
2) Netscape
3) Mozilla
4)Xupiter toolbar
McAfee's Xupiter Removal Instructions (Score:5, Informative)
I followed this on friend's computer and it works.
http://vil.nai.com/vil/content/v_99904.htm
Already given up (Score:5, Funny)
Actually, now that I think about it, my Redhat desktop is kind of boring.....
why are they allowed to do this? (Score:5, Interesting)
a thirteen year old kid writes a virus that emails itself to everyone in your address book. he's found, caught, sentenced and tossed in jail.
a company comes along and writes a piece of "software" that installs itself on your computer without your knowledge, changes your preferences, watches your every move and reports it back to the marketeers, and digs itself into your system so the only way to get it out is to reinstall your entire computer... (oops, by the way, now that you're using Microsoft products, you may just have to buy a new version due to licensing BS) ... and the worst that happens to the company is some negative press (which, as we all know, bad press is better than no press at all).
so, why the hell isn't the FBI busting these peoples' door down and arresting them? what is the damn difference between what they do and what script kiddies do?
Disclaimer: I am aware that I am exaggerating, are you?
A few questions answered: (Score:5, Informative)
Terms
- The Xupiter software will report back to our servers what applications may be running on your system and will resolve these conflicts whenever possible
- Xupiter has included an auto update
... upgrades may include installation of third party applications
- To further enhance your media viewing experience, Xupiter reserves the right to run advertisements and promotions
- . Our software license requires that users browser start page be set to Xupiter.com
Privacy PolicySo yeah, basically the program will pop-up-ad slam you, give away your personal info, install crap software on your PC, and has the ability to change it's "terms" to allow it to do more behind your back.
Re:A few questions answered: (Score:5, Funny)
To further enhance your media viewing experience, Xupiter reserves the right to run advertisements and promotions
To further enhance your sensory experience, Xtupider reserves the right to beat you upside the head with a large multi-colored baseball bat.
Going after Xupiter (Score:5, Informative)
Xupiter claims to be based in Hungary. But it may not be.
First, Xupiter appears to be the same thing as Browserwise [browserwise.com]. The content of the two sites match, and you can download their malware from either site.
Whois for Browserwise yields:
Administrative Contact: Inc., Browserwise, admin@browserwise.com
Browserwise, Inc
15445 Ventura Blvd
Sherman Oaks, California 91413
United States
(818)229-5631
Technical Contact: Inc., Browserwise, admin@browserwise.com
Browserwise, Inc
15445 Ventura Blvd
Sherman Oaks, California 90413
United States
(818)229-5631
Domain servers in listed order:
NS1.CANDIDHOSTING.COM
NS2.CANDIDHOSTING.COM
A traceroute on Xupiter isn't particularly helpful, but a traceroute on Browserwise leads to "amateurpornhouse.com", hosted on the same server. The server is thus virtual hosted by name, but if you try it by IP address [slashdot.org], you get Browserwise, so Browserwise is the main user of that server. "amateurpornouse" is thus either affiliated with Browserwise, or buys hosting from them.
Whois for "amateurpornhouse.com" yields:
SC Enterprises
P.O. Box 91114
Henderson, NV 89009
US
(702) 224-7750
Domain Name: AMATEURPORNHOUSE.COM
Administrative Contact:
Phucksum, Jeff webmaster@sexycouple.com
P.O. Box 91114
Henderson, NV 89009
US
(702) 224-7750
So we check Sexycouple's legal page [sexycouple.com], and find:
- Custodian of records for SC Enterprises: All records required to be maintained by 18 USC 2257 are kept by the custodian of records, Barry Levinson, 2810 South Rainbow Blvd. Las Vegas NV. 89146.
(Presumably this is not the well-known film director Barry Levinson.)Looking up "SC Enterprises" in Las Vegas, we get
134 Spinnaker Dr
Henderson, NV 89015-5639
Phone: (702) 558-8908
Also, DNS for Browserwise is provided by CandidHosting.com [candidhosting.com], next to the police station in Tampa, FL. They have to know who's behind this, so that's where to start with legal process.
That should be enough to get the lawyers started.
I think you're wrong... (Score:4, Informative)
Browserwise.com seems to be a totally different company, even the top level where the IP range is purchased from is different. Browserwise.com is hosted at the top level by Level 3 Communcations, while xupiter.com is hosted at the top level by Quest. I looked at both web sites (with Lynx! it's safe... ^_^) and the content does NOT seem to "match" to me.
Sorry but I think you just got carried away in your search and these two companies are not the same, or even related in anyway.
When are these companies gonna be held accountable (Score:4, Insightful)
I think they should be shut down and prosecuted for this stuff, along with all the other companies that install spyware.
Done! (Score:4, Informative)
xupiter.com has address 63.236.32.50
mail is handled by mx1.xupiter.com
host mx1.xupiter.com
mx1.xupiter.com has address 63.236.50.196
whois -h whois.arin.net 63.236.32.50
Qwest Communications NET-QWEST-BLKS2 (NET-63-236-0-0-1)
63.236.0.0 - 63.239.255.255
Qwest Cybercenters QWEST-CYBERCENTER (NET-63-236-0-0-2)
63.236.0.0 - 63.236.127.255
Internext Media, Inc. QWEST-JSV-INTERNEXT1 (NET-63-236-32-0-1)
63.236.32.0 - 63.236.32.63
whois -h whois.arin.net 63.236.50.196
Qwest Communications NET-QWEST-BLKS2 (NET-63-236-0-0-1)
63.236.0.0 - 63.239.255.255
Qwest Cybercenters QWEST-CYBERCENTER (NET-63-236-0-0-2)
63.236.0.0 - 63.236.127.255
Snapshot Productions LLC. QWEST-JSV-SNPSHTPR (NET-63-236-50-192-1)
63.236.50.192 - 63.236.50.223
so I added 63.236.32.0 - 63.236.32.63 and 63.236.50.192 - 63.236.50.223
to my firewall block list, and they shalt never trouble me henceforth.
Done! Next!
Where do I get this toolbar? (Score:4, Funny)
My systems are set up as minimally as possible for efficiency and reliability. For the life of me, I can't figure out how people manage to screw up their computers as badly as they often do.
I have many friends who have enormous hard drives and have filled them to the brim with all kinds of programs and downloads. Their computers, which are some of the fastest around in terms of hardware resources, run more slowly than an old 286 would if it was running Windows XP through a Pentium IV emulator written in Microsoft GW-BASIC, where the emulator's "RAM" and its processor registers reside on a slow tape drive, with each register on opposite ends of the tape. Oh, and did I mention all the graphics, sounds, windows, and other garbage that shows up all the time as they're running their computer? Just so you understand, all they ever do is write emails and write text in a word processor. But their computers are filled to the brim with crap.
I think the xupiter toolbar would be an innovative addition to my friends' highly optimized configuration.
Sincerely,
The Negra Modelo Troll
P.S., I drink Guinness too. I know I've talked smack on its flavor in the past but you have to find a bartender who knows how to pour and serve it. I can't stand the stuff out of bottles.
Re:Sick the Lawyers on Them (Score:5, Funny)
Every time I wiggle my mouse around or push my spacebar I need a law to clearly define what I'm doing, what my rights and responsibilities are, and what the punishments are if I wiggle that mouse a little bit too far to the left!
Laws, laws, more laws! We dont have enough laws!
People are too stupid to live lives themselves or take any sort of personal responsibility! We need laws and lawyers and lawsuits!
More LAWS! Laws are the answer.
I'm writing my congressman right now, demanding more and increasingly complicated laws!
Re:Sick the Lawyers on Them (Score:5, Insightful)
Re:Sick the Lawyers on Them (Score:3, Insightful)
Umm, if most people don't care, why should most representatives?
You want to get lawyers and litigation rolling for something like this when there is such a backlog of legislation pending in areas like, say, healthcare where most people DO care? There is a reason "our" voice is small on "legal" matters like this: It's because it's a waste of legislators' time!
Re:*groan* (Score:3, Informative)
Re:This is old news (Score:5, Informative)
Complete uninstall? (Score:5, Informative)
I don't know about this week's version of the uninstaller, but previous versions were nice enough to leave behind big chunks of the program. Still running. Sort of the way a tick will leave its head behind if you yank it out with tweezers.
This is a pretty common and ugly tactic among spyware developers.
Re:Ouch.. (Score:5, Informative)
Re:Ouch.. (Score:5, Informative)
- Our software license requires that users browser start page be set to Xupiter.com in order to continue use of the Xupiter toolbar, from time to time we verify that users start page url is set to Xupiter.com, if it is not we reserve the right to alter it back.
It just gets worse and worse...Let me summarize those terms: (Score:5, Funny)
Occasionally there will be software that stops our software. Our servers will report this back to us, and we will update our vir^h^h^hsoftware to shut this off. Software known to conflict with ours include Norton Antivirus, Symantec Antivirus, and several firewall utilities.
If we can find any information that is incriminating about you, we will sell it back to you for a price that we decide is right. Or maybe we we'll just keep the info and charge you a monthly fee not to tell anybody.
We may use your computer to propagate our software to other users by e-mailing everyone on your address book, and any IP addresses that you contact. We may also delete some of your programs to make more space for ours.
Finally, if we decide to, we will use your computer to participate in a DDOS attack of anyone we want. Thank you for using Xupiter. We hope you enjoy using our software as much as we do.
Re:Ouch.. (Score:5, Informative)
http://www.doxdesk.com/parasite/Xupiter.html
Or use Spybot S'n'D to remove it - Ad-Aware 5 hasn't been updated and can't get rid of all variants of it properly.
This page:
http://www.doxdesk.com/parasite/
will test you for Xupiter and 60-odd other nasties, if you're using IE.
girlfriends? (Score:3, Funny)
Re:Misplaced blame (Score:3, Informative)
Re:Sympathy (Score:5, Insightful)
And the woman who wears provocative clothing is asking to get raped.
What about the poor sods who have to use IE at work? What about technical neophytes? Should nobody be allowed to use a computer until they've studied CS for a couple of years and know who RMS is? I use Opera--quite happily--at home but I'm posting this (unfortunately) from a machine at work with IE, on which another browser is not an option. Educating an employer is often a slow, painful, laborious process. I'm trying, but it takes time.
Re:Sympathy (Score:4, Interesting)
Re:Xupiter.com War Story (Score:4, Interesting)
One of my Citrix users in a remote branch managed to install Hotbar (I won't link to this particular piece of scumware) into her Outlook. What's amazing about this is that i have specifically locked them out of installing anything through policies but yet this little jewel managed to get through.
To make things worse I first noticed it when I logged into the box from home and found that I had it. And so did the other 150 users.
Talk about pissed. I punted everyone out of the system until I could manually go through every user's registry settings and nuke the little bastard which was the only way to get rid of it.