Scumware contained in some of the Logons
Thursday, January 16, 2003 by d1g3r4t1 | Discussion: WinCustomize Talk
I came across some scumware, when unzipping one of the logons. I sent a message to wincustomize's IT people to advise same. THeir response was that I was stupid and didn't know what I was talking about. The exchange is appended:
Subject: Re: Fwd: scumware
To: "Stardock Support"
LMAO.......you use MS Security, there's a well know oxymoron. The scum installed WHILE I was downloading, and unzipping, the Logons. The scum is contained in one of the zipped files. I see that, instead of checking the problem, your IT people chastise people for reporting such things.
Xupiter does not work on a time delay, it runs at the next bootup/restart. As I have ActiveX controls disabled, it cannot install on my system. Additionally, it installs as an IE toolbar....NOT a standalone active desktop utility.
Seems you need to learn to read what people report........not assume that they are stupid and you are 'Holier Than Thou'.
Thanks for nothing
Stardock Support wrote:
Dear Sir,
None of the skin files contain executables, so it is not possible
that it came from our site. However, if you had recently been
surfing the next, you most likely ran into a web site that did not
protect themselves against Xupiter, which is spyware which will
download and install on your computer from an infected web site
usually on a time delay. We use all current MS internet securities
that safeguard us from such attacks.
Thank you,
Angie
On Wed, 15 Jan 2003 11:42:22 -0500, Stardock General Information
wrote:
>==================BEGIN FORWARDED MESSAGE==================
>>Return-path:
>>Received: from web12402.mail.yahoo.com ([216.136.173.129])
>> by stardock.com ([127.0.0.1])
>> with SMTP (MDaemon.PRO.v6.0.3.R)
>> for ; Wed, 15 Jan 2003 10:57:27 -0500
>>Message-ID:
>>Received: from [24.129.45.113] by web12402.mail.yahoo.com via HTTP; Wed, 15 Jan 2003 08:00:44 PST
>>Date: Wed, 15 Jan 2003 08:00:44 -0800 (PST)
>>From: Doyle
>>Subject: scumware
>>To: [email protected]
>>MIME-Version: 1.0
>>Content-Type: multipart/alternative; boundary="0-1469653529-1042646444=:7431"
>>X-MDRcpt-To: [email protected]
>>X-MDRemoteIP: 216.136.173.129
>>X-Return-Path: [email protected]
>>X-MDaemon-Deliver-To: [email protected]
>
>
>
>
>Last night, while downloading Logons, for Stardock's LogonStudio(TM), at least one of them installed scumware on my system. Specifically, an active
>desktop componant which was a large 'Search toolbar' style piece of scumware. Took me almost 2 hours to track this slime down, and turn it off (Registry,
>Run) I've yet to find the scumware so I can delete it. IF you bother to find and remove the file(s) containing this slime, I would greatly appreciate being
>advised on how to find and remove the scumware that installed on my system.
>
>Thank you, Doyle aka Citizen d1g3r4t1
Subject: Re: Fwd: scumware
To: "Stardock Support"
LMAO.......you use MS Security, there's a well know oxymoron. The scum installed WHILE I was downloading, and unzipping, the Logons. The scum is contained in one of the zipped files. I see that, instead of checking the problem, your IT people chastise people for reporting such things.
Xupiter does not work on a time delay, it runs at the next bootup/restart. As I have ActiveX controls disabled, it cannot install on my system. Additionally, it installs as an IE toolbar....NOT a standalone active desktop utility.
Seems you need to learn to read what people report........not assume that they are stupid and you are 'Holier Than Thou'.
Thanks for nothing
Stardock Support wrote:
Dear Sir,
None of the skin files contain executables, so it is not possible
that it came from our site. However, if you had recently been
surfing the next, you most likely ran into a web site that did not
protect themselves against Xupiter, which is spyware which will
download and install on your computer from an infected web site
usually on a time delay. We use all current MS internet securities
that safeguard us from such attacks.
Thank you,
Angie
On Wed, 15 Jan 2003 11:42:22 -0500, Stardock General Information
wrote:
>==================BEGIN FORWARDED MESSAGE==================
>>Return-path:
>>Received: from web12402.mail.yahoo.com ([216.136.173.129])
>> by stardock.com ([127.0.0.1])
>> with SMTP (MDaemon.PRO.v6.0.3.R)
>> for ; Wed, 15 Jan 2003 10:57:27 -0500
>>Message-ID:
>>Received: from [24.129.45.113] by web12402.mail.yahoo.com via HTTP; Wed, 15 Jan 2003 08:00:44 PST
>>Date: Wed, 15 Jan 2003 08:00:44 -0800 (PST)
>>From: Doyle
>>Subject: scumware
>>To: [email protected]
>>MIME-Version: 1.0
>>Content-Type: multipart/alternative; boundary="0-1469653529-1042646444=:7431"
>>X-MDRcpt-To: [email protected]
>>X-MDRemoteIP: 216.136.173.129
>>X-Return-Path: [email protected]
>>X-MDaemon-Deliver-To: [email protected]
>
>
>
>
>Last night, while downloading Logons, for Stardock's LogonStudio(TM), at least one of them installed scumware on my system. Specifically, an active
>desktop componant which was a large 'Search toolbar' style piece of scumware. Took me almost 2 hours to track this slime down, and turn it off (Registry,
>Run) I've yet to find the scumware so I can delete it. IF you bother to find and remove the file(s) containing this slime, I would greatly appreciate being
>advised on how to find and remove the scumware that installed on my system.
>
>Thank you, Doyle aka Citizen d1g3r4t1
 |
|
Page 5 of 12 | |
|
|---|
Cavanaugh
Reply #82 Thursday, January 16, 2003 5:12 PM
Reply #82 Thursday, January 16, 2003 5:12 PM
hrm - if you found the run key in the registry, the data member contains the path and location of the executable.
werewolf
Reply #83 Thursday, January 16, 2003 5:32 PM
Reply #83 Thursday, January 16, 2003 5:32 PM
Well I'll tell you what... I will defend Stardock support with every ounce of energy I have. Comparing them to practically anyone else is insulting and ignorant. They have *always* been professional, thourough and complete when I have had problems. There is another user here who had *so* many problems with his machine (not Stardock software, his personal machine) for months. Stardock folks helped him out way, way, way beyond the call of duty. They even put a switch in the Windowblinds .ini file to help him fix his hardware problems. Please don't ever talk about the quality of support here. It is, hands down, the best support I've ever seen from any kind of software, hardware, appliance, whatever, company.
goodmorphing
Reply #85 Thursday, January 16, 2003 5:45 PM
Reply #85 Thursday, January 16, 2003 5:45 PM
Wolfie, if our missing emoticon was a flower, I would give it to you right here and now!
Jafo
Reply #86 Thursday, January 16, 2003 5:50 PM
Reply #86 Thursday, January 16, 2003 5:50 PM
First things first.
A private email to a company is STILL private between the sender and the recipient, irrespective of whether either is a group of individuals.....authority to read is determined by the principal of the company.
Public disclosure containing unsubstantiated allegations is called 'Libel', as it intends to defame a party.
A 'suggestion' that your 'problem' originated via warez-hunting is reasonable as I am sufficiently grown-up to know what goes on.....been there, done that....AND I'm not averse to the odd porn or two...[call me honest, here]...I fully understand the vile popups and popunders and browser hijacking that occurs, having experienced it myself many times.
The difference is that I have NEVER found the equivalent spyware or 'scum' as you call it here on Wincustomize.com or any of the other Skinning sites.
Yes, it is entirely feasible that you were elsewhere 'unsavoury' and then came here to dl, skins, etc to pretty up the warez'ed proggies. Why? Because we KNOW it happens....and there are many more proggies being skinned by works here that are NOT 'free'.
Misspell my name once more in a deliberate attempt to be a childish prat and your access rights to this site will be revoked.
Site administrators, such as KarmaGirl do not deserve their private communications aired publicly, and I don't need to waste my life dealing with a recalcitrant pain in the butt who resorts to infantile slight.
As mentioned previously, this should have been handled via direct communication with a full, clear background of cause and effect, something that COULD be acted upon.
It appears kthxbye has isolated the 'zips' from the others and STILL found nothing.
How's your Internet 'History' looking? Can we see a list of the last couple of dozen sites visited PRIOR to your 'problem' or would that be 'too revealing'?.
I await your considered response,
Yours sincerely,
Paul Martin
JAFO.......[that's J...A...F...O]
A private email to a company is STILL private between the sender and the recipient, irrespective of whether either is a group of individuals.....authority to read is determined by the principal of the company.
Public disclosure containing unsubstantiated allegations is called 'Libel', as it intends to defame a party.
A 'suggestion' that your 'problem' originated via warez-hunting is reasonable as I am sufficiently grown-up to know what goes on.....been there, done that....AND I'm not averse to the odd porn or two...[call me honest, here]...I fully understand the vile popups and popunders and browser hijacking that occurs, having experienced it myself many times.
The difference is that I have NEVER found the equivalent spyware or 'scum' as you call it here on Wincustomize.com or any of the other Skinning sites.
Yes, it is entirely feasible that you were elsewhere 'unsavoury' and then came here to dl, skins, etc to pretty up the warez'ed proggies. Why? Because we KNOW it happens....and there are many more proggies being skinned by works here that are NOT 'free'.
Misspell my name once more in a deliberate attempt to be a childish prat and your access rights to this site will be revoked.
Site administrators, such as KarmaGirl do not deserve their private communications aired publicly, and I don't need to waste my life dealing with a recalcitrant pain in the butt who resorts to infantile slight.
As mentioned previously, this should have been handled via direct communication with a full, clear background of cause and effect, something that COULD be acted upon.
It appears kthxbye has isolated the 'zips' from the others and STILL found nothing.
How's your Internet 'History' looking? Can we see a list of the last couple of dozen sites visited PRIOR to your 'problem' or would that be 'too revealing'?.
I await your considered response,
Yours sincerely,
Paul Martin
JAFO.......[that's J...A...F...O]
kthxbye
Reply #87 Thursday, January 16, 2003 5:54 PM
Reply #87 Thursday, January 16, 2003 5:54 PM
Hey, I was just sitting around trying to motivate myself to do non-cleaning related stuff, it was nothing. 
Koasati
Reply #88 Thursday, January 16, 2003 6:21 PM
Reply #88 Thursday, January 16, 2003 6:21 PM
I leave the house for 7 hours, and come back to find this thread still at the top of the board......... 
Not surprised nothing was found.
As a bonus, I find confirmation that not using WinZip is a good idea!
Not surprised nothing was found.
As a bonus, I find confirmation that not using WinZip is a good idea!
WOM
Reply #89 Thursday, January 16, 2003 6:52 PM
Reply #89 Thursday, January 16, 2003 6:52 PM
Took a full 45 min. to read this thread and still came away with nothing. Does it or doesn't it. Who knows, and the saga continues.
citats
Reply #90 Thursday, January 16, 2003 8:17 PM
Reply #90 Thursday, January 16, 2003 8:17 PM
Citizen d1g3r4t1
Consider the possibility that you had your browser open at the same time and like many websites out there today they try and push gator/search toolbar and others at you thru a popup script that you must click ok to activate. so you mouse went to the button you clicked and now you have a scum/spy or ware of some sort. The fact you were unzipping logon files was coincidence. Thank you for the potential warning but I advise you review the websites you visited and determin which one is running this script.
Consider the possibility that you had your browser open at the same time and like many websites out there today they try and push gator/search toolbar and others at you thru a popup script that you must click ok to activate. so you mouse went to the button you clicked and now you have a scum/spy or ware of some sort. The fact you were unzipping logon files was coincidence. Thank you for the potential warning but I advise you review the websites you visited and determin which one is running this script.
WOM
Reply #92 Thursday, January 16, 2003 8:59 PM
Reply #92 Thursday, January 16, 2003 8:59 PM
Yeah Iben, I should have done that too. I wouldn't have missed much as everything was repeated on each page. >
I wouldn't have missed much as everything was repeated on each page. >
d1g3r4t1
Reply #93 Thursday, January 16, 2003 9:49 PM
Reply #93 Thursday, January 16, 2003 9:49 PM
kthxbye, if you will re-read his post, found all BUT one of the files. Thus he has NOT cleared this site. Perhaps one of you found the offending skin and removed it already.
hmmmmmmmmmmmmmmmm
hmmmmmmmmmmmmmmmm
d1g3r4t1
Reply #94 Thursday, January 16, 2003 9:50 PM
Reply #94 Thursday, January 16, 2003 9:50 PM
Since installing Proximitron, about a year ago, I've not seen a single popup/under etc.
d1g3r4t1
Reply #95 Thursday, January 16, 2003 9:52 PM
Reply #95 Thursday, January 16, 2003 9:52 PM
Company communications are not private. Ask any lawyer. Accuse me of downloading Warez again and "I" will have one teach you the meaning of Libel.
d1g3r4t1
Reply #96 Thursday, January 16, 2003 9:54 PM
Reply #96 Thursday, January 16, 2003 9:54 PM
Feel free to remove anything you wish. You have been invited to twice before. Not like anyone couldn't create new accounts in 30 seconds.
d1g3r4t1
Reply #97 Thursday, January 16, 2003 9:56 PM
Reply #97 Thursday, January 16, 2003 9:56 PM
When you track down and clear the one file that kthxbye did NOT find, come back and talk.
kthxbye
Reply #98 Thursday, January 16, 2003 9:59 PM
Reply #98 Thursday, January 16, 2003 9:59 PM
*And off in the corner, in the comfy chair next to the fireplace, kthxbye sits there finally relaxing after a long pissy day of job hunting and dealing with the present snowfall scratching his head in puzzlement*
Wow, okay. Uhm... yeah. Somehow, I really doubt this. I do. No, really, I do. Now, it just seems you're convinced the problem /has/ to lie here, when in all actuality, every single little bit of evidence, points to anyplace, anything /but/ here.
Unless... it truly goes far, far deeper than this! A-ha! That is it! It's the previously unknown Wincustomize conspiracy - threatening to undermine everything we hold dear! Watson, the game is afoot!
Ahem, or not. Allow me to reiterate.. yeah, uhm, I just don't think so.
Hrm - I really need some caffeine..
Wow, okay. Uhm... yeah. Somehow, I really doubt this. I do. No, really, I do. Now, it just seems you're convinced the problem /has/ to lie here, when in all actuality, every single little bit of evidence, points to anyplace, anything /but/ here.
Unless... it truly goes far, far deeper than this! A-ha! That is it! It's the previously unknown Wincustomize conspiracy - threatening to undermine everything we hold dear! Watson, the game is afoot!
Ahem, or not. Allow me to reiterate.. yeah, uhm, I just don't think so.
Hrm - I really need some caffeine..
kthxbye
Reply #99 Thursday, January 16, 2003 10:04 PM
Reply #99 Thursday, January 16, 2003 10:04 PM
I also meant to point out that I didn't find the one logon because I hadn't planned on devoting a large portion of my life to tracking down these evil creatures - and the downloaded file name (from the list given by digerati,) doesn't always coincide with the name of the theme itself in the library. Enh.
d1g3r4t1
Reply #100 Thursday, January 16, 2003 10:05 PM
Reply #100 Thursday, January 16, 2003 10:05 PM
>Yes, it is entirely feasible that you were elsewhere 'unsavoury' >and then came here to dl, skins, etc to pretty up the warez'ed >proggies. Why? Because we KNOW it happens....and there are many >more proggies being skinned by works here that are NOT 'free'.
Morally and legally inexcusable
Morally and legally inexcusable
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
|
|
Page 5 of 12 | |
|
|---|
Reply #81 Thursday, January 16, 2003 5:11 PM
I download every single logon from digerati's list.
Out of all of these, 1 of them I couldn't find (sorry,) and out of the remaining, 5 of them are zip files:
Cheshire, MedalofHonour, stoplogon, StrongholdLogon and XP1_Bindi
All of them contain the exact same thing inside - the apropriate logonxp file and nothing else. (Well, if you want to get technical, Cheshire and Stronghold also contain UI icons.)
Now... to solve the mystery of lunch... er... dinner.