Scumware contained in some of the Logons
Thursday, January 16, 2003 by d1g3r4t1 | Discussion: WinCustomize Talk
I came across some scumware, when unzipping one of the logons. I sent a message to wincustomize's IT people to advise same. THeir response was that I was stupid and didn't know what I was talking about. The exchange is appended:
Subject: Re: Fwd: scumware
To: "Stardock Support"
LMAO.......you use MS Security, there's a well know oxymoron. The scum installed WHILE I was downloading, and unzipping, the Logons. The scum is contained in one of the zipped files. I see that, instead of checking the problem, your IT people chastise people for reporting such things.
Xupiter does not work on a time delay, it runs at the next bootup/restart. As I have ActiveX controls disabled, it cannot install on my system. Additionally, it installs as an IE toolbar....NOT a standalone active desktop utility.
Seems you need to learn to read what people report........not assume that they are stupid and you are 'Holier Than Thou'.
Thanks for nothing
Stardock Support wrote:
Dear Sir,
None of the skin files contain executables, so it is not possible
that it came from our site. However, if you had recently been
surfing the next, you most likely ran into a web site that did not
protect themselves against Xupiter, which is spyware which will
download and install on your computer from an infected web site
usually on a time delay. We use all current MS internet securities
that safeguard us from such attacks.
Thank you,
Angie
On Wed, 15 Jan 2003 11:42:22 -0500, Stardock General Information
wrote:
>==================BEGIN FORWARDED MESSAGE==================
>>Return-path:
>>Received: from web12402.mail.yahoo.com ([216.136.173.129])
>> by stardock.com ([127.0.0.1])
>> with SMTP (MDaemon.PRO.v6.0.3.R)
>> for ; Wed, 15 Jan 2003 10:57:27 -0500
>>Message-ID:
>>Received: from [24.129.45.113] by web12402.mail.yahoo.com via HTTP; Wed, 15 Jan 2003 08:00:44 PST
>>Date: Wed, 15 Jan 2003 08:00:44 -0800 (PST)
>>From: Doyle
>>Subject: scumware
>>To: [email protected]
>>MIME-Version: 1.0
>>Content-Type: multipart/alternative; boundary="0-1469653529-1042646444=:7431"
>>X-MDRcpt-To: [email protected]
>>X-MDRemoteIP: 216.136.173.129
>>X-Return-Path: [email protected]
>>X-MDaemon-Deliver-To: [email protected]
>
>
>
>
>Last night, while downloading Logons, for Stardock's LogonStudio(TM), at least one of them installed scumware on my system. Specifically, an active
>desktop componant which was a large 'Search toolbar' style piece of scumware. Took me almost 2 hours to track this slime down, and turn it off (Registry,
>Run) I've yet to find the scumware so I can delete it. IF you bother to find and remove the file(s) containing this slime, I would greatly appreciate being
>advised on how to find and remove the scumware that installed on my system.
>
>Thank you, Doyle aka Citizen d1g3r4t1
Subject: Re: Fwd: scumware
To: "Stardock Support"
LMAO.......you use MS Security, there's a well know oxymoron. The scum installed WHILE I was downloading, and unzipping, the Logons. The scum is contained in one of the zipped files. I see that, instead of checking the problem, your IT people chastise people for reporting such things.
Xupiter does not work on a time delay, it runs at the next bootup/restart. As I have ActiveX controls disabled, it cannot install on my system. Additionally, it installs as an IE toolbar....NOT a standalone active desktop utility.
Seems you need to learn to read what people report........not assume that they are stupid and you are 'Holier Than Thou'.
Thanks for nothing
Stardock Support wrote:
Dear Sir,
None of the skin files contain executables, so it is not possible
that it came from our site. However, if you had recently been
surfing the next, you most likely ran into a web site that did not
protect themselves against Xupiter, which is spyware which will
download and install on your computer from an infected web site
usually on a time delay. We use all current MS internet securities
that safeguard us from such attacks.
Thank you,
Angie
On Wed, 15 Jan 2003 11:42:22 -0500, Stardock General Information
wrote:
>==================BEGIN FORWARDED MESSAGE==================
>>Return-path:
>>Received: from web12402.mail.yahoo.com ([216.136.173.129])
>> by stardock.com ([127.0.0.1])
>> with SMTP (MDaemon.PRO.v6.0.3.R)
>> for ; Wed, 15 Jan 2003 10:57:27 -0500
>>Message-ID:
>>Received: from [24.129.45.113] by web12402.mail.yahoo.com via HTTP; Wed, 15 Jan 2003 08:00:44 PST
>>Date: Wed, 15 Jan 2003 08:00:44 -0800 (PST)
>>From: Doyle
>>Subject: scumware
>>To: [email protected]
>>MIME-Version: 1.0
>>Content-Type: multipart/alternative; boundary="0-1469653529-1042646444=:7431"
>>X-MDRcpt-To: [email protected]
>>X-MDRemoteIP: 216.136.173.129
>>X-Return-Path: [email protected]
>>X-MDaemon-Deliver-To: [email protected]
>
>
>
>
>Last night, while downloading Logons, for Stardock's LogonStudio(TM), at least one of them installed scumware on my system. Specifically, an active
>desktop componant which was a large 'Search toolbar' style piece of scumware. Took me almost 2 hours to track this slime down, and turn it off (Registry,
>Run) I've yet to find the scumware so I can delete it. IF you bother to find and remove the file(s) containing this slime, I would greatly appreciate being
>advised on how to find and remove the scumware that installed on my system.
>
>Thank you, Doyle aka Citizen d1g3r4t1
 |
|
Page 4 of 12 | |
|
|---|
d1g3r4t1
Reply #62 Thursday, January 16, 2003 11:28 AM
Reply #62 Thursday, January 16, 2003 11:28 AM
Paxx. The "Smartmove" didn't activate it. It moved me to the offending button, when that window popped to the top of the stack. As I was clicking away, on another program, I was still clicking, thus pressing the "Yes"/"OK" whatever button and granting permission for it to install. This doesn't occur very often. Usually, when it does, I'm typing something and no harm is done. This one I file under "Stuff happens"
(I loathe programs that steal the focus)
(I loathe programs that steal the focus)
paxx
Reply #63 Thursday, January 16, 2003 11:38 AM
Reply #63 Thursday, January 16, 2003 11:38 AM
OK then, so where did that offending window come from? It's not possible to get any third party window coming up when executing a LogonXP file.
I really really think you got your scumware somewhere else.
I really really think you got your scumware somewhere else.
KarmaGirl
Reply #64 Thursday, January 16, 2003 11:40 AM
Reply #64 Thursday, January 16, 2003 11:40 AM
I think #6 is the most likely answer since *none* of us have been able to find this alleged file, and, even though this topic is at the top, *nobody* has jumped in to say that they experienced the same thing.
I would also like you to explain why you posted a "private" email publicly and bashed on the site, Stardock, and me without giving us a fair chance to even try to figure out what in heck you are accusing us of? That just lacks class no matter how you look at it.
I would also like you to explain why you posted a "private" email publicly and bashed on the site, Stardock, and me without giving us a fair chance to even try to figure out what in heck you are accusing us of? That just lacks class no matter how you look at it.
pjpowell
Reply #65 Thursday, January 16, 2003 11:48 AM
Reply #65 Thursday, January 16, 2003 11:48 AM
Erm. Nobody looks dumb except you. You said spyware was installed while installing a logonxp file. What is a logonxip file? A zip file. What does installing a logonxp file do? It unzips the contents of that file to a folder on your hard drive. Please tell me where the opportunity for installing scumware is in this?
If you had said:
'Hi, I think I may have accidentally double clicked on an executable contained in one of the zip files I downloaded from your website. You may want to check them to see if someone has included an executable. The ones I downloaded are/were : '
I would most probably not be sitting here typing this right now.
Angela's reponse to you was fine. She may have made some incorrect assumptions but under the circumstances they were perfectly justified and in most cases would probably have helped the complainant to track down the cause. There is a known spyware called xupiter which behaves in the same way you describe so the assumptions seem justified to me. The fact that it got on your computer immediately puts doubts on your security setup. However it's true that you can have all the security in the world but it's the person behind the keyboard that is the most risk.
It shows an lack of respect and common decency to post her response to you in a public forum in this way and to ridicule her for trying to help you. All of this could have been dealt with simply by replying to her (after all she was the one who responded to your request) and would have caused a lot less aggro.
If you had said:
'Hi, I think I may have accidentally double clicked on an executable contained in one of the zip files I downloaded from your website. You may want to check them to see if someone has included an executable. The ones I downloaded are/were : '
I would most probably not be sitting here typing this right now.
Angela's reponse to you was fine. She may have made some incorrect assumptions but under the circumstances they were perfectly justified and in most cases would probably have helped the complainant to track down the cause. There is a known spyware called xupiter which behaves in the same way you describe so the assumptions seem justified to me. The fact that it got on your computer immediately puts doubts on your security setup. However it's true that you can have all the security in the world but it's the person behind the keyboard that is the most risk.
It shows an lack of respect and common decency to post her response to you in a public forum in this way and to ridicule her for trying to help you. All of this could have been dealt with simply by replying to her (after all she was the one who responded to your request) and would have caused a lot less aggro.
d1g3r4t1
Reply #66 Thursday, January 16, 2003 11:52 AM
Reply #66 Thursday, January 16, 2003 11:52 AM
Paxx.......again....the file popped up at the end of the unzipp....not when executing the logon file. Winzip, at least, pops up the 'Install Now?' window, if an exe is present, and/or opens the folder that the file was unzipped to.
d1g3r4t1
Reply #67 Thursday, January 16, 2003 11:54 AM
Reply #67 Thursday, January 16, 2003 11:54 AM
KarmaGirl - Odd that you continue bashing me when the files in question have yet to be checked.
d1g3r4t1
Reply #68 Thursday, January 16, 2003 12:02 PM
Reply #68 Thursday, January 16, 2003 12:02 PM
Pipowell - If an exe file is included in an archive, Winzip will pop up the 'Install Yes/No' window.
As, has been stated multiple times here, I did not know the exact file, and provided the info that I could. Instead of responding in a correct manner I got the usual brush off response.
Assumptions are NEVER justified. If I recall the witticism correctly, "Assumptions are the mother of all ......ups"
This thread has only been here a couple of hours.
My responses are a reaction to being belittled.
No security is airtight, and is only as good as the last update. Ask everyone who has been hit by the Yaho virus, in the last few days, WHILE running the latest versions of Norton and McCaffe (SP?) Anti-virus.
As, has been stated multiple times here, I did not know the exact file, and provided the info that I could. Instead of responding in a correct manner I got the usual brush off response.
Assumptions are NEVER justified. If I recall the witticism correctly, "Assumptions are the mother of all ......ups"
This thread has only been here a couple of hours.
My responses are a reaction to being belittled.
No security is airtight, and is only as good as the last update. Ask everyone who has been hit by the Yaho virus, in the last few days, WHILE running the latest versions of Norton and McCaffe (SP?) Anti-virus.
KarmaGirl
Reply #69 Thursday, January 16, 2003 12:07 PM
Reply #69 Thursday, January 16, 2003 12:07 PM
I looked at them. Didn't see anything that shouldn't be there. Maybe I missed something- but I doubt it.
I am not "bashing" you. You brought this to the public forum. I am responding in the public forum.
Please answer the second part of my last response, and read PJPowell's response.
If you want to accuse a site/company of wrong doing, you should have the cold hard facts to prove it. You don't even know the name of the program installed or the file that it supposedly came from. You have provided *no* facts to substantiate your claims.
I am not "bashing" you. You brought this to the public forum. I am responding in the public forum.
Please answer the second part of my last response, and read PJPowell's response.
If you want to accuse a site/company of wrong doing, you should have the cold hard facts to prove it. You don't even know the name of the program installed or the file that it supposedly came from. You have provided *no* facts to substantiate your claims.
DYSEQTA
Reply #70 Thursday, January 16, 2003 12:17 PM
Reply #70 Thursday, January 16, 2003 12:17 PM
Oh for the love of God d1g3r4t1, just shut up and go away 
What you are proposing is simply impossible. Not only that but your "story" has become the most elaborate collection of bull**** i have ever come across.
Here's what I propose as the most likely cause of your problem: You were surfing a porn/warez site in the background whilst mass unziping logons and got caught by a web-popup. Deal with it. >
What you are proposing is simply impossible. Not only that but your "story" has become the most elaborate collection of bull**** i have ever come across.Here's what I propose as the most likely cause of your problem: You were surfing a porn/warez site in the background whilst mass unziping logons and got caught by a web-popup. Deal with it. >
d1g3r4t1
Reply #71 Thursday, January 16, 2003 12:24 PM
Reply #71 Thursday, January 16, 2003 12:24 PM
Karma, company communications are not Private.
I've read PJPowell's response, and responded as well.
Where have accused anyone of anything? My communication is advisory.
I've provided all data possible. The name of the program was "Search Toolbar". Prove that it did not come from one of these archives. If I were a programmer, I would be able to pull up the program, try to decompile the program and get more information, not to mention sending same to Spybot and Ad-aware for inclusion therein.
My attempt to advise of a problem where met with brush offs, belittling, and acqusations of illegal activity. All BEFORE anyone had even bothered to look into things.
I've read PJPowell's response, and responded as well.
Where have accused anyone of anything? My communication is advisory.
I've provided all data possible. The name of the program was "Search Toolbar". Prove that it did not come from one of these archives. If I were a programmer, I would be able to pull up the program, try to decompile the program and get more information, not to mention sending same to Spybot and Ad-aware for inclusion therein.
My attempt to advise of a problem where met with brush offs, belittling, and acqusations of illegal activity. All BEFORE anyone had even bothered to look into things.
d1g3r4t1
Reply #72 Thursday, January 16, 2003 12:26 PM
Reply #72 Thursday, January 16, 2003 12:26 PM
Raven, what occured is VERY possible. I do not engage in ware'z or porn. Point of logic. If I had, why would I come here?
paxx
Reply #73 Thursday, January 16, 2003 12:32 PM
Reply #73 Thursday, January 16, 2003 12:32 PM
d1: problem is there is no ZPI file in the list you supplied earlier, therefore Winzip wouldn't touch them. All those LongonXP files would be handled by Longon XP, which does NOT open a "Install now?" window if it finds an exe.
DYSEQTA
Reply #74 Thursday, January 16, 2003 12:55 PM
Reply #74 Thursday, January 16, 2003 12:55 PM
Point of logic?
1. What has Porn got to do with wincustomize
2. Why wouldnt warez users come here?
Oh stuff it, that's the last thing I say. Im not going to get wrapped up in some silly argument.
1. What has Porn got to do with wincustomize
2. Why wouldnt warez users come here?
Oh stuff it, that's the last thing I say. Im not going to get wrapped up in some silly argument.
KarmaGirl
Reply #75 Thursday, January 16, 2003 12:56 PM
Reply #75 Thursday, January 16, 2003 12:56 PM
d1g3r4t1 - "Where have accused anyone of anything?"
When you stated publicly "The scum installed WHILE I was downloading, and unzipping, the Logons. The scum is contained in one of the zipped files."
Forgetting what you wrote? That sounds like an accusation to me.
No ZIP files in the files that you stated you downloaded. No proof that the executable came from this site.
And, all you give as the name of the program is ""Search Toolbar", which the only program that I have found that is named that comes from: http://www.searchtoolbar.com/ which is a voluntary download and install.
When you stated publicly "The scum installed WHILE I was downloading, and unzipping, the Logons. The scum is contained in one of the zipped files."
Forgetting what you wrote? That sounds like an accusation to me.
No ZIP files in the files that you stated you downloaded. No proof that the executable came from this site.
And, all you give as the name of the program is ""Search Toolbar", which the only program that I have found that is named that comes from: http://www.searchtoolbar.com/ which is a voluntary download and install.
Chef Garry
Reply #76 Thursday, January 16, 2003 3:37 PM
Reply #76 Thursday, January 16, 2003 3:37 PM
Can you say Troll?
Sure, I knew you could.
>
Sure, I knew you could.
>
d1g3r4t1
Reply #77 Thursday, January 16, 2003 4:45 PM
Reply #77 Thursday, January 16, 2003 4:45 PM
Try downloading the files in question. Some of them are zipped. Not very many, they're rather small.
In the grand scheme of things, this is the exact same sort of responses I get from IT departments, customer service, etc....whether by email or phone....if I've got a simple question or have a complaint or, as in this case, try to advise someone of a simple problem. Micro$loth being the worst offender. People assume, read the 1st 2 lines and ignore the rest, and in this thread, people jumping in with stuff when they didn't read the entire thread, etc. ad nausium. It's almost as bad government employees. And this is the first time the response has included acqusations of illigal activity. UNBELIEVABLE.
Excuse the hell out of me for giving a hoot.
In the grand scheme of things, this is the exact same sort of responses I get from IT departments, customer service, etc....whether by email or phone....if I've got a simple question or have a complaint or, as in this case, try to advise someone of a simple problem. Micro$loth being the worst offender. People assume, read the 1st 2 lines and ignore the rest, and in this thread, people jumping in with stuff when they didn't read the entire thread, etc. ad nausium. It's almost as bad government employees. And this is the first time the response has included acqusations of illigal activity. UNBELIEVABLE.
Excuse the hell out of me for giving a hoot.
d1g3r4t1
Reply #78 Thursday, January 16, 2003 4:48 PM
Reply #78 Thursday, January 16, 2003 4:48 PM
KarmaGirl
Search toolbar is the only name listed in /run registry setting. How else would I find a name? As stated numerous times in the thread....."I" installed it by accident. Why is this so hard to understand?
Search toolbar is the only name listed in /run registry setting. How else would I find a name? As stated numerous times in the thread....."I" installed it by accident. Why is this so hard to understand?
d1g3r4t1
Reply #79 Thursday, January 16, 2003 4:54 PM
Reply #79 Thursday, January 16, 2003 4:54 PM
wytraven.......Someone else back in the thread brought up the porn. Not being familiar with Ware'z, outside of what I've seen reported on TechTV, I couldn't see coming here to advise about download procurred somewhere else. Furthermore, the product in question is a free one, how would warez have anything to do with it.
It was Jofo who accused me downloading warez, way back in the beginning of the thread. Why he thought Warez would have anything to do with a free product is beyond me.
It was Jofo who accused me downloading warez, way back in the beginning of the thread. Why he thought Warez would have anything to do with a free product is beyond me.
d1g3r4t1
Reply #80 Thursday, January 16, 2003 4:59 PM
Reply #80 Thursday, January 16, 2003 4:59 PM
oh, wrt there not being a zip file in the list I provided. Thats because I had already unzipped the files, and deleted zipped archive. I don't know which of the files were zipped, only that there were 10 or so of them. I had already run the recycle bin through my 'Shredder' program, thus I cannot pull them back up to see the original zipped files. This is clearly stated, several times, throughout the thread.
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
|
|
Page 4 of 12 | |
|
|---|
Reply #61 Thursday, January 16, 2003 11:21 AM
>I was the "stupid one" that even bothered answering his email. I >had assumed that a) since he didn't mention what files he was >downloading and
Correct. You assumed.
>I have to wonder: If this is really here. And millions of people >download from here. Why is this the only report? Doesn't seem >logical to me at all.
1. Some of the files I downloaded had very few previous downloads.
2. Perhaps no one else made the connection between the scum and a download.
3. Perhaps they did, but didn't know where it came from.
4. Perhaps they didn't bother reporting it. (I've been quilty of this many times).
5. Perhaps they did report it and ran into the same attitudes.
6. Perhaps I'm wrong.
Better to be safe, than sorry, eh?