Scumware contained in some of the Logons
Thursday, January 16, 2003 by d1g3r4t1 | Discussion: WinCustomize Talk
I came across some scumware, when unzipping one of the logons. I sent a message to wincustomize's IT people to advise same. THeir response was that I was stupid and didn't know what I was talking about. The exchange is appended:
Subject: Re: Fwd: scumware
To: "Stardock Support"
LMAO.......you use MS Security, there's a well know oxymoron. The scum installed WHILE I was downloading, and unzipping, the Logons. The scum is contained in one of the zipped files. I see that, instead of checking the problem, your IT people chastise people for reporting such things.
Xupiter does not work on a time delay, it runs at the next bootup/restart. As I have ActiveX controls disabled, it cannot install on my system. Additionally, it installs as an IE toolbar....NOT a standalone active desktop utility.
Seems you need to learn to read what people report........not assume that they are stupid and you are 'Holier Than Thou'.
Thanks for nothing
Stardock Support wrote:
Dear Sir,
None of the skin files contain executables, so it is not possible
that it came from our site. However, if you had recently been
surfing the next, you most likely ran into a web site that did not
protect themselves against Xupiter, which is spyware which will
download and install on your computer from an infected web site
usually on a time delay. We use all current MS internet securities
that safeguard us from such attacks.
Thank you,
Angie
On Wed, 15 Jan 2003 11:42:22 -0500, Stardock General Information
wrote:
>==================BEGIN FORWARDED MESSAGE==================
>>Return-path:
>>Received: from web12402.mail.yahoo.com ([216.136.173.129])
>> by stardock.com ([127.0.0.1])
>> with SMTP (MDaemon.PRO.v6.0.3.R)
>> for ; Wed, 15 Jan 2003 10:57:27 -0500
>>Message-ID:
>>Received: from [24.129.45.113] by web12402.mail.yahoo.com via HTTP; Wed, 15 Jan 2003 08:00:44 PST
>>Date: Wed, 15 Jan 2003 08:00:44 -0800 (PST)
>>From: Doyle
>>Subject: scumware
>>To: [email protected]
>>MIME-Version: 1.0
>>Content-Type: multipart/alternative; boundary="0-1469653529-1042646444=:7431"
>>X-MDRcpt-To: [email protected]
>>X-MDRemoteIP: 216.136.173.129
>>X-Return-Path: [email protected]
>>X-MDaemon-Deliver-To: [email protected]
>
>
>
>
>Last night, while downloading Logons, for Stardock's LogonStudio(TM), at least one of them installed scumware on my system. Specifically, an active
>desktop componant which was a large 'Search toolbar' style piece of scumware. Took me almost 2 hours to track this slime down, and turn it off (Registry,
>Run) I've yet to find the scumware so I can delete it. IF you bother to find and remove the file(s) containing this slime, I would greatly appreciate being
>advised on how to find and remove the scumware that installed on my system.
>
>Thank you, Doyle aka Citizen d1g3r4t1
Subject: Re: Fwd: scumware
To: "Stardock Support"
LMAO.......you use MS Security, there's a well know oxymoron. The scum installed WHILE I was downloading, and unzipping, the Logons. The scum is contained in one of the zipped files. I see that, instead of checking the problem, your IT people chastise people for reporting such things.
Xupiter does not work on a time delay, it runs at the next bootup/restart. As I have ActiveX controls disabled, it cannot install on my system. Additionally, it installs as an IE toolbar....NOT a standalone active desktop utility.
Seems you need to learn to read what people report........not assume that they are stupid and you are 'Holier Than Thou'.
Thanks for nothing
Stardock Support wrote:
Dear Sir,
None of the skin files contain executables, so it is not possible
that it came from our site. However, if you had recently been
surfing the next, you most likely ran into a web site that did not
protect themselves against Xupiter, which is spyware which will
download and install on your computer from an infected web site
usually on a time delay. We use all current MS internet securities
that safeguard us from such attacks.
Thank you,
Angie
On Wed, 15 Jan 2003 11:42:22 -0500, Stardock General Information
wrote:
>==================BEGIN FORWARDED MESSAGE==================
>>Return-path:
>>Received: from web12402.mail.yahoo.com ([216.136.173.129])
>> by stardock.com ([127.0.0.1])
>> with SMTP (MDaemon.PRO.v6.0.3.R)
>> for ; Wed, 15 Jan 2003 10:57:27 -0500
>>Message-ID:
>>Received: from [24.129.45.113] by web12402.mail.yahoo.com via HTTP; Wed, 15 Jan 2003 08:00:44 PST
>>Date: Wed, 15 Jan 2003 08:00:44 -0800 (PST)
>>From: Doyle
>>Subject: scumware
>>To: [email protected]
>>MIME-Version: 1.0
>>Content-Type: multipart/alternative; boundary="0-1469653529-1042646444=:7431"
>>X-MDRcpt-To: [email protected]
>>X-MDRemoteIP: 216.136.173.129
>>X-Return-Path: [email protected]
>>X-MDaemon-Deliver-To: [email protected]
>
>
>
>
>Last night, while downloading Logons, for Stardock's LogonStudio(TM), at least one of them installed scumware on my system. Specifically, an active
>desktop componant which was a large 'Search toolbar' style piece of scumware. Took me almost 2 hours to track this slime down, and turn it off (Registry,
>Run) I've yet to find the scumware so I can delete it. IF you bother to find and remove the file(s) containing this slime, I would greatly appreciate being
>advised on how to find and remove the scumware that installed on my system.
>
>Thank you, Doyle aka Citizen d1g3r4t1
 |
|
Page 3 of 12 | |
|
|---|
d1g3r4t1
Reply #42 Thursday, January 16, 2003 10:05 AM
Reply #42 Thursday, January 16, 2003 10:05 AM
kthxbye.......I don't catch the wrong thing very often, if anything, I end up typing in the wrong window. But, it works for me 
Koasati
Reply #43 Thursday, January 16, 2003 10:06 AM
Reply #43 Thursday, January 16, 2003 10:06 AM
Oh, that Smartmove.......... I hate that........... I use a Logitech mouse, but without the software.
Jafo
Reply #44 Thursday, January 16, 2003 10:06 AM
Reply #44 Thursday, January 16, 2003 10:06 AM
I'm running Intellipoint which does the same thing.
It does NOT catch clicks, but pre-empts the most likely [default] button to hover over, saving you the 'move'.
Really no help at all in locating a source of the problem...
It does NOT catch clicks, but pre-empts the most likely [default] button to hover over, saving you the 'move'.
Really no help at all in locating a source of the problem...
kthxbye
Reply #45 Thursday, January 16, 2003 10:07 AM
Reply #45 Thursday, January 16, 2003 10:07 AM
Kosati: I'd found looking up SmartMove on google to be an exercise in futility - there are simply far too many apps or other things named Smartmove out there!
digerati/anyone else: I also know I've installed at least 1/3rd of those logons at one time with no ill effects - but, but help that is, since I don't remember which ones. ^.^
digerati/anyone else: I also know I've installed at least 1/3rd of those logons at one time with no ill effects - but, but help that is, since I don't remember which ones. ^.^
Jafo
Reply #46 Thursday, January 16, 2003 10:12 AM
Reply #46 Thursday, January 16, 2003 10:12 AM
OK...I've saved that list...and I'll DL them all and look.
If the 82 meg is found to be clean and I have wasted my time I'll be really jovial and high spirited, hugs all round....[yeah, right]...
If the 82 meg is found to be clean and I have wasted my time I'll be really jovial and high spirited, hugs all round....[yeah, right]...
kthxbye
Reply #47 Thursday, January 16, 2003 10:13 AM
Reply #47 Thursday, January 16, 2003 10:13 AM
Hey - I'm supposed to be job hunting - but if you wat to split that list up and farm some of it off to somebody else....
Koasati
Reply #48 Thursday, January 16, 2003 10:17 AM
Reply #48 Thursday, January 16, 2003 10:17 AM
82 megs......... heck, I could have that downloaded in a week or so........
Jafo
Reply #49 Thursday, January 16, 2003 10:18 AM
Reply #49 Thursday, January 16, 2003 10:18 AM
kthxbye...no, that's OK...better an Admin kills his comp with some nasty than one of the public...
I mean...better than one of the public killing their comp, not an Admin killing their comp with a member of the public....
Ah, pedantry....can be fun....
I mean...better than one of the public killing their comp, not an Admin killing their comp with a member of the public....
Ah, pedantry....can be fun....
wombat_1
Reply #50 Thursday, January 16, 2003 10:18 AM
Reply #50 Thursday, January 16, 2003 10:18 AM
Jeez ...."is reading comprehension not taught on SKOOL anymore?" ...... aside from majoring in bad manners and pig ignorance this clod certainly missed the spelling and grammar class!
Nuke it Jafo. >
Nuke it Jafo. >
Jafo
Reply #51 Thursday, January 16, 2003 10:20 AM
Reply #51 Thursday, January 16, 2003 10:20 AM
It'll have to be in a while, though...it's 2.18AM, Friday here....
Jafo
Reply #52 Thursday, January 16, 2003 10:22 AM
Reply #52 Thursday, January 16, 2003 10:22 AM
He spelled 'comprehension' correctly, though....perhaps 'SKOOL' is a 'Yank thang'....
paxx
Reply #53 Thursday, January 16, 2003 10:22 AM
Reply #53 Thursday, January 16, 2003 10:22 AM
Not a single file with the ZIP extension in that list...
Can you explain how you unzipped them or installed them, or what you did to them that would have activated a spyware?
Can you explain how you unzipped them or installed them, or what you did to them that would have activated a spyware?
kthxbye
Reply #54 Thursday, January 16, 2003 10:24 AM
Reply #54 Thursday, January 16, 2003 10:24 AM
Well, you know - only when you're trying to be 'old skool' - ahem.
And - works for me Jafo - I'll just conviniently forget to mention that I've installed next to nothing on my notebook and my restore CDs are always right at an arm's length away. I don't want to be killed by an admin after all! Er, I mean... my notebook. That's it.
And - works for me Jafo - I'll just conviniently forget to mention that I've installed next to nothing on my notebook and my restore CDs are always right at an arm's length away. I don't want to be killed by an admin after all! Er, I mean... my notebook. That's it.
paxx
Reply #55 Thursday, January 16, 2003 10:27 AM
Reply #55 Thursday, January 16, 2003 10:27 AM
Jafo: I'll start looking at them. I'm running Linux at the moment, so I'm safe.
I'll let you know where I'm at before you start as well.
I'll let you know where I'm at before you start as well.
Keila
Reply #56 Thursday, January 16, 2003 10:35 AM
Reply #56 Thursday, January 16, 2003 10:35 AM
All righty then!
Jafo, I hope you sleep well tonight, you deserve it after dealing with this.
Jafo, I hope you sleep well tonight, you deserve it after dealing with this.
Jafo
Reply #57 Thursday, January 16, 2003 10:40 AM
Reply #57 Thursday, January 16, 2003 10:40 AM
Patric...time to hit the hay....I need my 'beauty sleep' [never helps any]....
I'll still lay odds that these are all clean.
We know nothing about his 'history' and what other proggies he may or may not have been using or have installed....
A quick lesson in logic.
3 Professors on a train going from England to Scotland.
They cross the border and see a black sheep in a field.
The first Prof states...
"All sheep in Scotland are black."
Second prof corrects...
"At least one sheep in Scotland is black."
Third prof responds...
"At least one sheep in Scotland is black on at least one of its sides".
Determining 'fact' or 'cause' from limited 'observation' can really get you nowhere real fast...
I'll still lay odds that these are all clean.
We know nothing about his 'history' and what other proggies he may or may not have been using or have installed....
A quick lesson in logic.
3 Professors on a train going from England to Scotland.
They cross the border and see a black sheep in a field.
The first Prof states...
"All sheep in Scotland are black."
Second prof corrects...
"At least one sheep in Scotland is black."
Third prof responds...
"At least one sheep in Scotland is black on at least one of its sides".
Determining 'fact' or 'cause' from limited 'observation' can really get you nowhere real fast...
KarmaGirl
Reply #58 Thursday, January 16, 2003 10:41 AM
Reply #58 Thursday, January 16, 2003 10:41 AM
Jafo- "He spelled 'comprehension' correctly, though....perhaps 'SKOOL' is a 'Yank thang'...."
Yeah, he is being a "Yank" alright (and I don't mean that as being "American"
I was the "stupid one" that even bothered answering his email. I had assumed that a) since he didn't mention what files he was downloading and
he never mentioned the name of this "scumware" that he was talking about the ever feared Xupiter.
I have to wonder: If this is really here. And millions of people download from here. Why is this the only report? Doesn't seem logical to me at all.
Of course, that might just be me and my 'Holier Than Thou' attitude again And I obviously started that whole disrespectful response with "Dear Sir". I guess instead of emailing "polite" responses like I did, I should just say: "Either give the name of the file downloaded and the name of the so called executable that you *claim* it installed, or go away!" Ok, I guess I said that, anyway
I love these "warnings" that can not be backed up with proof. Reminds me of all those email urban legends.
Bad mood...have not had coffee yet....
Yeah, he is being a "Yank" alright (and I don't mean that as being "American"
I was the "stupid one" that even bothered answering his email. I had assumed that a) since he didn't mention what files he was downloading and
he never mentioned the name of this "scumware" that he was talking about the ever feared Xupiter.I have to wonder: If this is really here. And millions of people download from here. Why is this the only report? Doesn't seem logical to me at all.
Of course, that might just be me and my 'Holier Than Thou' attitude again
And I obviously started that whole disrespectful response with "Dear Sir". I guess instead of emailing "polite" responses like I did, I should just say: "Either give the name of the file downloaded and the name of the so called executable that you *claim* it installed, or go away!" Ok, I guess I said that, anyway I love these "warnings" that can not be backed up with proof. Reminds me of all those email urban legends.
Bad mood...have not had coffee yet....
d1g3r4t1
Reply #59 Thursday, January 16, 2003 10:47 AM
Reply #59 Thursday, January 16, 2003 10:47 AM
The spelling of SKOOL was on purpose. Is moronic irony not recognized these days?
I didn't start with the bad manners and sly accusations. I do, however, get that way when dealing with people who ASSume out of pig ignorance.
When asked for tech support, or someone tries to advise you of something, the correct response is to politely ASK if they've done this, this, and this. Ask questions regarding the incident. Gather as much information as possible. This is even more important if what they've advised seems cryptic to you. Do not assume they do not know what Xupiter is, do not have heavy security on their computer (A must with a broadband connection), not have multiple decades of experience, haven't already run Spybot and Ad-aware, know where to find things in the registry. Don't start with, it can't have been from us, until AFTER you've checked your systems...especially when you're using Microsoft products with their 'screen door on a submarine' security. Above all, NEVER accuse someone of illegal activity, no matter how slyly put, unless you've got proof of same that would stand up in court. Or make yourself look dumb, by making comments about your own products, that are incorrect.
I didn't start with the bad manners and sly accusations. I do, however, get that way when dealing with people who ASSume out of pig ignorance.
When asked for tech support, or someone tries to advise you of something, the correct response is to politely ASK if they've done this, this, and this. Ask questions regarding the incident. Gather as much information as possible. This is even more important if what they've advised seems cryptic to you. Do not assume they do not know what Xupiter is, do not have heavy security on their computer (A must with a broadband connection
), not have multiple decades of experience, haven't already run Spybot and Ad-aware, know where to find things in the registry. Don't start with, it can't have been from us, until AFTER you've checked your systems...especially when you're using Microsoft products with their 'screen door on a submarine' security. Above all, NEVER accuse someone of illegal activity, no matter how slyly put, unless you've got proof of same that would stand up in court. Or make yourself look dumb, by making comments about your own products, that are incorrect.
paxx
Reply #60 Thursday, January 16, 2003 11:12 AM
Reply #60 Thursday, January 16, 2003 11:12 AM
OK, apologies then d1.
But I still don't understand how your Logitech Smartmove could have activated a spyware.
When running a LogonXP file, it's sent to LogonXP, which in turn uncompresses the file and moves it to the LogonXP directory. That's it. It doesn't execute any script or executable contained in the said archived LogonXP document. It's only when actually opening LogonXP and selecting the particular logon and applying it that it reads the INI file it contains. Even then, the INI file needs very particular expected variables and ignores anything that it doesn't understand. It is impossible to script the execution of a program in a LogonXP INI file.
More info is needed. As I asked previously, what did you do in particular, or what did Smartmove do to the LogonXP file? It seems very improbable that any LogonXP file could be infected.
But I still don't understand how your Logitech Smartmove could have activated a spyware.
When running a LogonXP file, it's sent to LogonXP, which in turn uncompresses the file and moves it to the LogonXP directory. That's it. It doesn't execute any script or executable contained in the said archived LogonXP document. It's only when actually opening LogonXP and selecting the particular logon and applying it that it reads the INI file it contains. Even then, the INI file needs very particular expected variables and ignores anything that it doesn't understand. It is impossible to script the execution of a program in a LogonXP INI file.
More info is needed. As I asked previously, what did you do in particular, or what did Smartmove do to the LogonXP file? It seems very improbable that any LogonXP file could be infected.
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
|
|
Page 3 of 12 | |
|
|---|
Reply #41 Thursday, January 16, 2003 10:04 AM
Contents of G:\Downloads\ThemeXP\Login Screens\
At 1/16/2003 10:00:13 AM 59 Files 82.31Mb
Abe.logonxp 768.09Kb A 1/15/2003 5:02:14 AM
AnimalNap.logonxp 2.41Mb A 1/15/2003 4:31:30 AM
BluScape.logonxp 2.06Mb A 1/15/2003 4:55:24 AM
Cheshire.logonXP 438.57Kb A 1/7/2002 6:40:14 AM
Colony_logonxp.logonxp 1.46Mb A 1/15/2003 3:46:40 AM
CopperDeck_II-logon.logonxp 384.56Kb A 1/15/2003 4:26:08 AM
Earth & Beyond.logonxp 545.77Kb A 9/24/2002 4:53:44 PM
EarthAndBeyond.logonxp 980.27Kb A 1/15/2003 4:28:10 AM
F-22.logonxp 1.11Mb A 1/15/2003 4:27:58 AM
FBI1152x864.logonxp 2.39Mb A 1/15/2003 3:34:42 AM
FeelthePower.logonxp 999.04Kb A 1/15/2003 3:52:24 AM
fishpaste.logonxp 1.74Mb A 1/15/2003 5:05:58 AM
Floydian.logonxp 364.91Kb A 1/15/2003 3:33:18 AM
Gothic.logonxp 105.83Kb A 1/15/2003 4:32:26 AM
GraveyardPumpkins.logonxp 954.99Kb A 1/15/2003 4:25:42 AM
Green_X-FILES.logonXP 286.91Kb A 1/15/2003 5:22:40 AM
HAL9000logon.logonxp 1.69Mb A 1/15/2003 5:05:02 AM
HappyHolyday.logonxp 6.68Mb A 1/15/2003 3:46:28 AM
JumbledCircuits2002.logonxp 5.64Mb A 1/15/2003 4:43:00 AM
LCARS.logonxp 175.64Kb A 1/15/2003 3:42:40 AM
LCARS2.logonxp 117.78Kb A 12/21/2002 10:14:42 PM
logonui.logonxp 2.17Mb A 1/15/2003 5:09:40 AM
matrix1.logonxp 1.83Mb A 1/15/2003 4:52:24 AM
Medal of Honour.logonXP 2.28Mb A 2/9/2002 8:46:46 PM
Medieval.logonxp 235.88Kb A 1/15/2003 3:54:22 AM
metallogon.logonxp 1.45Mb A 1/15/2003 3:44:22 AM
MilitaryC42.logonxp 915.85Kb A 1/15/2003 4:30:14 AM
MyPlace.logonxp 2.55Mb A 1/15/2003 3:53:30 AM
NarnRegimeLogon.logonxp 1.88Mb A 1/15/2003 5:00:58 AM
Nuke.logonxp 939.71Kb A 1/15/2003 3:43:36 AM
Pumpkinhead.logonxp 635.73Kb A 1/15/2003 4:26:56 AM
Pumpkins.logonxp 1.98Mb A 1/15/2003 4:27:32 AM
RedDragon.logonxp 1.29Mb A 1/15/2003 4:29:30 AM
RELOADED.logonxp 1.59Mb A 8/23/2002 10:31:22 PM
rustysteel.logonxp 954.00Kb A 1/15/2003 5:23:56 AM
Sailing.logonxp 3.49Mb A 1/15/2003 4:32:52 AM
SantaatNorthPole.logonxp 733.04Kb A 1/15/2003 3:52:52 AM
SantasWatching.logonxp 2.52Mb A 1/15/2003 3:43:00 AM
SG-1ChevronLocked.logonxp 258.41Kb A 1/15/2003 4:32:14 AM
Sinister_Lantern.logonxp 284.29Kb A 1/15/2003 4:27:42 AM
SpaceEye.logonxp 2.16Mb A 1/15/2003 5:01:26 AM
SShock2.logonxp 1.56Mb A 1/15/2003 4:56:38 AM
SShock2v101-1.logonxp 920.78Kb A 1/15/2003 4:56:58 AM
StarTrek1.logonxp 302.43Kb A 1/15/2003 4:28:36 AM
StarTrek2.logonxp 307.16Kb A 1/15/2003 4:28:30 AM
stop.logonxp 541.70Kb A 3/12/2002 6:39:02 PM
Stronghold.logonXP 569.99Kb A 1/5/2002 9:50:00 PM
SUVAndXmasTree.logonxp 1.95Mb A 1/15/2003 3:52:40 AM
TheBug.logonxp 1.13Mb A 1/15/2003 3:53:58 AM
TheMatrixhasyou.logonxp 3.31Mb A 1/15/2003 4:38:50 AM
uicon.jpg 9.72Kb A 1/7/2002 6:38:48 AM
user1.bmp 7.47Kb A 1/5/2002 9:28:00 PM
user2.bmp 7.47Kb A 1/5/2002 9:29:00 PM
user3.bmp 7.47Kb A 1/5/2002 9:29:00 PM
user4.bmp 7.47Kb A 1/5/2002 9:29:00 PM
WhatIstheMatrix.logonxp 1.36Mb A 1/15/2003 4:40:04 AM
Wheel.logonxp 5.02Mb A 1/15/2003 3:47:26 AM
XP1_Bindi.logonxp 2.95Mb A 3/10/2002 5:11:14 PM
YuleTide.logonxp 1.09Mb A 1/15/2003 3:54:52 AM