what's with this xupiter crap?
Sunday, January 12, 2003 by happytimes_2001 | Discussion: WinCustomize Talk
now have a ton of this xupter tool bars on my system even when I do not run it from the component tray it installs itself. does any one know how to get this piece of crap out of here.
thanks
thanks
Delicious
Reply #2 Sunday, January 12, 2003 8:52 AM
Reply #2 Sunday, January 12, 2003 8:52 AM
There is another thread with the removal instructions. Perhaps someone can post that here.
THere are several registry keys to eliminate and an activex before you can delete the Xuipter folder.
Follow the instructions and don't try to remove it uninstructed because it will screw up your search in IE if not removed properly.
THere are several registry keys to eliminate and an activex before you can delete the Xuipter folder.
Follow the instructions and don't try to remove it uninstructed because it will screw up your search in IE if not removed properly.
ScruffyGuy
Reply #3 Wednesday, January 15, 2003 5:51 AM
Reply #3 Wednesday, January 15, 2003 5:51 AM
If anyone can please provide the link to where the removal instructions are located, I'd greatly appreciate it. Stinking, rotten, miserable Xupiter installed itself on my PC a few days ago after linking to some ambiguous website. It has nothing to do with WinCustomize or Stardock.
Perhaps if I can provide a bit more info, some of the more tech savvy folks out there may be able to help as well...
I DO have AdAware and I used it after the Xupiter installed itself. The uninstall program provided by Xupiter did NOTHING -- not even a response to a double click. An email to Xupiter was quickly returned -- "mailbox full." Problem being... I was so uptight about it I used RegEdit and deleted every stinking reference from the Registry. The offensive program is now gone, but I have a blank space when I right click any toolbar. The space is available to be checked as a toolbar option, but nothing happens since the program is gone.
In short, (sorry, I know it wasn't too short), what I need are the valid, default Registry keys for Explorer toolbars (IE is part of Explorer, and the Xupiter flub affects ALL toolbars). My system is fine, but it bugs me to no end to have that stupid blank space leftover. I'd like to just have the standard Windows default toolbar options (and Google, of course -- gotta have Google).
Many thanks in advance. Even a few suggestions on where to find a list of Registry keys would be terrific. MS Knowledge Base is of no help, and sadly, Google searches aren't, either.
Perhaps if I can provide a bit more info, some of the more tech savvy folks out there may be able to help as well...
I DO have AdAware and I used it after the Xupiter installed itself. The uninstall program provided by Xupiter did NOTHING -- not even a response to a double click. An email to Xupiter was quickly returned -- "mailbox full." Problem being... I was so uptight about it I used RegEdit and deleted every stinking reference from the Registry. The offensive program is now gone, but I have a blank space when I right click any toolbar. The space is available to be checked as a toolbar option, but nothing happens since the program is gone.
In short, (sorry, I know it wasn't too short), what I need are the valid, default Registry keys for Explorer toolbars (IE is part of Explorer, and the Xupiter flub affects ALL toolbars). My system is fine, but it bugs me to no end to have that stupid blank space leftover. I'd like to just have the standard Windows default toolbar options (and Google, of course -- gotta have Google).
Many thanks in advance. Even a few suggestions on where to find a list of Registry keys would be terrific. MS Knowledge Base is of no help, and sadly, Google searches aren't, either.
Jafo
Reply #4 Wednesday, January 15, 2003 6:54 AM
Reply #4 Wednesday, January 15, 2003 6:54 AM
Scruffy...I found and posted the instructions after a five minute search on Google....was 'easy as'....but that thread is a way back....I'll see if I can dig it up...
Jafo
Reply #5 Wednesday, January 15, 2003 7:00 AM
Reply #5 Wednesday, January 15, 2003 7:00 AM
3 by Jafo - 1/2/2003 8:19:52 AM
A 2 minute search found me these instructions for removing the spyware....
Open the registry (from the Start menu, click Run and enter regedit) and find the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Delete the 'XupiterStartup' entry in the Right Hand pane.
Also delete the following Registry Keys:
HKEY_CURRENT_USER\Software\Xupiter
HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units\{A27CFCAE-9351-4D74-BFFC-21EB19693D8C}
Reboot, and delete the entire Program Files\Xupiter directory.
You're also likely to have a Xupiter ActiveX object in your Downloaded Program Files folder. Find that one, rightclick it, and choose properties. It has the following ID: {A27CFCAE-9351-4D74-BFFC-21EB19693D8C}
Now rightclick the file, and choose delete.
Next, delete the Xupiter folder in Program Files.
Finally, go to Internet Options/Programs, and hit "Reset Web Settings".
A 2 minute search found me these instructions for removing the spyware....
Open the registry (from the Start menu, click Run and enter regedit) and find the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Delete the 'XupiterStartup' entry in the Right Hand pane.
Also delete the following Registry Keys:
HKEY_CURRENT_USER\Software\Xupiter
HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units\{A27CFCAE-9351-4D74-BFFC-21EB19693D8C}
Reboot, and delete the entire Program Files\Xupiter directory.
You're also likely to have a Xupiter ActiveX object in your Downloaded Program Files folder. Find that one, rightclick it, and choose properties. It has the following ID: {A27CFCAE-9351-4D74-BFFC-21EB19693D8C}
Now rightclick the file, and choose delete.
Next, delete the Xupiter folder in Program Files.
Finally, go to Internet Options/Programs, and hit "Reset Web Settings".
Fuzzy Logic
Reply #6 Wednesday, January 15, 2003 8:22 AM
Reply #6 Wednesday, January 15, 2003 8:22 AM
This program seems very invasive. I wonder if there's a good way of preventing it in the first place?
Delicious
Reply #7 Wednesday, January 15, 2003 8:33 AM
Reply #7 Wednesday, January 15, 2003 8:33 AM
Reboot, and delete the entire Program Files\Xupiter directory
I wonder about this because after you reboot the darn Xuipter dll file will put the registry keys back. I think delete and then reboot.
I wonder about this because after you reboot the darn Xuipter dll file will put the registry keys back. I think delete and then reboot.
Delicious
Reply #9 Wednesday, January 15, 2003 9:47 AM
Reply #9 Wednesday, January 15, 2003 9:47 AM
I did a search in regedit for Xuipter and deleted all entries but left the program folder.
I then later discovered they were back in the registry.
A bit of advice: I didn't use the instructions but used CTRL F and F3 in regedit and in the process screwed up the search in IE. Follow the yellow brick road because the damage is not repairable even with a reinstall of IE.
I then later discovered they were back in the registry.
A bit of advice: I didn't use the instructions but used CTRL F and F3 in regedit and in the process screwed up the search in IE. Follow the yellow brick road because the damage is not repairable even with a reinstall of IE.
ScruffyGuy
Reply #10 Wednesday, January 15, 2003 7:45 PM
Reply #10 Wednesday, January 15, 2003 7:45 PM
Yikes. I also used F3 within Regedit and had a field day deleting the references. What I did is delete an essential key by mistake, thereby leaving the blank, but checkable toolbar option. The good news for me is that I use only Google's search bar, and it functions the same as always, even after the blunder.
Thanks much for providing the pertinent registry keys. Possibly I didn't find the info on the web using Google because I refused to type "Xupiter" into the search window, fearing a rogue link to some site that would install it AGAIN. I did try every other possibly keyword combination, though!
I'll let you know if I can clear the problem with the provided fix. Regardless, my browser is none the worse for wear. Sincerely appreciate the above advice. Not a lazy fellow here; I don't mind doing some research to fix a problem, but it seemed fruitless.
Everyone hold hands and sing together, now: "We won't support spyware..."
Thanks much for providing the pertinent registry keys. Possibly I didn't find the info on the web using Google because I refused to type "Xupiter" into the search window, fearing a rogue link to some site that would install it AGAIN. I did try every other possibly keyword combination, though!
I'll let you know if I can clear the problem with the provided fix. Regardless, my browser is none the worse for wear. Sincerely appreciate the above advice. Not a lazy fellow here; I don't mind doing some research to fix a problem, but it seemed fruitless.
Everyone hold hands and sing together, now: "We won't support spyware..."
Delicious
Reply #11 Wednesday, January 15, 2003 9:57 PM
Reply #11 Wednesday, January 15, 2003 9:57 PM
Makes you think, Xuipter lists only a few keys to delete and I recall many more. I checked each key I deleted and everyone had Xuipter in it. I do the same with AOL and haven't had problems deleting the million AOL puts in the registry and I don't have AOL or AIM.
ScruffyGuy
Reply #12 Friday, January 17, 2003 1:21 AM
Reply #12 Friday, January 17, 2003 1:21 AM
A quick THANKS once again to everyone who helped out. The demon Xupiter has been vanquished.
See ya'll around.
See ya'll around.
IPlural
Reply #13 Friday, January 17, 2003 1:30 AM
Reply #13 Friday, January 17, 2003 1:30 AM
http://www.bulletproofsoft.com/ This is the one I run....
two words : Spy Watch
Monitor Started!
3:15:17 AM Warning! Gator Key detected: HKEY_CLASSES_ROOT\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\
3:15:17 AM Warning! Gator Key detected: HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\
3:15:17 AM Warning! Wurld Media Key detected: HKEY_CLASSES_ROOT\Interface\{3CB6DEF9-1DB2-4B5D-9A70-9BF8345ED73C}\
3:15:17 AM Warning! Wurld Media Key detected: HKEY_CLASSES_ROOT\Mbho.IEHlprObj\
3:15:17 AM Warning! Wurld Media Key detected: HKEY_CLASSES_ROOT\Mbho.IEHlprObj.1\
3:15:17 AM Warning! Wurld Media Key detected: HKEY_CLASSES_ROOT\TypeLib\{4769DD43-4045-405C-945F-752516445E89}\
3:15:17 AM Warning! Other Cookie detected: john@bfast[2].txt
3:15:17 AM Warning! HitBox Cookie detected: [email protected][2].txt
3:15:17 AM Warning! HitBox Cookie detected: john@hitbox[1].txt
3:15:17 AM Warning! Doubleclick Cookie detected: john@doubleclick[1].txt
3:15:17 AM Warning! Lop.com Cookie detected: [email protected][1].txt
3:15:17 AM Warning! ClickFinders Cookie detected: john@S005-01-8-30-216258-100254[1].txt
3:15:17 AM Warning! Hitslink Cookie detected: [email protected][2].txt
3:15:17 AM Warning! Avenue A Inc Cookie detected: john@atdmt[2].txt
3:16:17 AM Warning! Gator Key detected: HKEY_CLASSES_ROOT\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\
3:16:17 AM Warning! Gator Key detected: HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\
It gets them all and it does it real time....
two words : Spy Watch
Monitor Started!
3:15:17 AM Warning! Gator Key detected: HKEY_CLASSES_ROOT\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\
3:15:17 AM Warning! Gator Key detected: HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\
3:15:17 AM Warning! Wurld Media Key detected: HKEY_CLASSES_ROOT\Interface\{3CB6DEF9-1DB2-4B5D-9A70-9BF8345ED73C}\
3:15:17 AM Warning! Wurld Media Key detected: HKEY_CLASSES_ROOT\Mbho.IEHlprObj\
3:15:17 AM Warning! Wurld Media Key detected: HKEY_CLASSES_ROOT\Mbho.IEHlprObj.1\
3:15:17 AM Warning! Wurld Media Key detected: HKEY_CLASSES_ROOT\TypeLib\{4769DD43-4045-405C-945F-752516445E89}\
3:15:17 AM Warning! Other Cookie detected: john@bfast[2].txt
3:15:17 AM Warning! HitBox Cookie detected: [email protected][2].txt
3:15:17 AM Warning! HitBox Cookie detected: john@hitbox[1].txt
3:15:17 AM Warning! Doubleclick Cookie detected: john@doubleclick[1].txt
3:15:17 AM Warning! Lop.com Cookie detected: [email protected][1].txt
3:15:17 AM Warning! ClickFinders Cookie detected: john@S005-01-8-30-216258-100254[1].txt
3:15:17 AM Warning! Hitslink Cookie detected: [email protected][2].txt
3:15:17 AM Warning! Avenue A Inc Cookie detected: john@atdmt[2].txt
3:16:17 AM Warning! Gator Key detected: HKEY_CLASSES_ROOT\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\
3:16:17 AM Warning! Gator Key detected: HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\
It gets them all and it does it real time....
Delicious
Reply #15 Friday, January 17, 2003 9:06 AM
Reply #15 Friday, January 17, 2003 9:06 AM
What is the hitslink cookie? I see that comes from Wincustomize. Is it the message icon thing?
KarmaGirl
Reply #16 Friday, January 17, 2003 9:55 AM
Reply #16 Friday, January 17, 2003 9:55 AM
There are a couple cookies. One deals with your "history" on Stardock (like the "folder" icons and such), the other (iirc) is your logon info. Both will recreate themselves, so if you are paranoid and clean them everyday, the worst that will happen is that you lose your history on the page and have to log in each time (both are really convenience features).
Phydeaux_3
Reply #17 Friday, January 17, 2003 2:58 PM
Reply #17 Friday, January 17, 2003 2:58 PM
This is from TechTV (on preventing future Xupiter "takeovers"):
Once you remove Xupiter from your system, make sure you never install the ActiveX control again.
In Internet Explorer, click Tools and choose Internet Options.
Go to the Security tab, click the Restricted Sites icon, and then the Sites button.
Under "Add this Web site to the zone:" type xupiter.com and click Add.
Add other sites that have ActiveX controls similar to Xupiter. We recommend Gator.com and Comet Cursor.
Click OK.
You won't be prompted to download ActiveX controls from these sites ever again.
Hope that helps!
smooches,
» Phy³ . . .
Once you remove Xupiter from your system, make sure you never install the ActiveX control again.
In Internet Explorer, click Tools and choose Internet Options.
Go to the Security tab, click the Restricted Sites icon, and then the Sites button.
Under "Add this Web site to the zone:" type xupiter.com and click Add.
Add other sites that have ActiveX controls similar to Xupiter. We recommend Gator.com and Comet Cursor.
Click OK.
You won't be prompted to download ActiveX controls from these sites ever again.
Hope that helps!
smooches,
» Phy³ . . .
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
Reply #1 Sunday, January 12, 2003 5:36 AM
http://www.lavasoft.nu/index.html is the place to get it