Scumware contained in some of the Logons
Thursday, January 16, 2003 by d1g3r4t1 | Discussion: WinCustomize Talk
I came across some scumware, when unzipping one of the logons. I sent a message to wincustomize's IT people to advise same. THeir response was that I was stupid and didn't know what I was talking about. The exchange is appended:
Subject: Re: Fwd: scumware
To: "Stardock Support"
LMAO.......you use MS Security, there's a well know oxymoron. The scum installed WHILE I was downloading, and unzipping, the Logons. The scum is contained in one of the zipped files. I see that, instead of checking the problem, your IT people chastise people for reporting such things.
Xupiter does not work on a time delay, it runs at the next bootup/restart. As I have ActiveX controls disabled, it cannot install on my system. Additionally, it installs as an IE toolbar....NOT a standalone active desktop utility.
Seems you need to learn to read what people report........not assume that they are stupid and you are 'Holier Than Thou'.
Thanks for nothing
Stardock Support wrote:
Dear Sir,
None of the skin files contain executables, so it is not possible
that it came from our site. However, if you had recently been
surfing the next, you most likely ran into a web site that did not
protect themselves against Xupiter, which is spyware which will
download and install on your computer from an infected web site
usually on a time delay. We use all current MS internet securities
that safeguard us from such attacks.
Thank you,
Angie
On Wed, 15 Jan 2003 11:42:22 -0500, Stardock General Information
wrote:
>==================BEGIN FORWARDED MESSAGE==================
>>Return-path:
>>Received: from web12402.mail.yahoo.com ([216.136.173.129])
>> by stardock.com ([127.0.0.1])
>> with SMTP (MDaemon.PRO.v6.0.3.R)
>> for ; Wed, 15 Jan 2003 10:57:27 -0500
>>Message-ID:
>>Received: from [24.129.45.113] by web12402.mail.yahoo.com via HTTP; Wed, 15 Jan 2003 08:00:44 PST
>>Date: Wed, 15 Jan 2003 08:00:44 -0800 (PST)
>>From: Doyle
>>Subject: scumware
>>To: [email protected]
>>MIME-Version: 1.0
>>Content-Type: multipart/alternative; boundary="0-1469653529-1042646444=:7431"
>>X-MDRcpt-To: [email protected]
>>X-MDRemoteIP: 216.136.173.129
>>X-Return-Path: [email protected]
>>X-MDaemon-Deliver-To: [email protected]
>
>
>
>
>Last night, while downloading Logons, for Stardock's LogonStudio(TM), at least one of them installed scumware on my system. Specifically, an active
>desktop componant which was a large 'Search toolbar' style piece of scumware. Took me almost 2 hours to track this slime down, and turn it off (Registry,
>Run) I've yet to find the scumware so I can delete it. IF you bother to find and remove the file(s) containing this slime, I would greatly appreciate being
>advised on how to find and remove the scumware that installed on my system.
>
>Thank you, Doyle aka Citizen d1g3r4t1
Subject: Re: Fwd: scumware
To: "Stardock Support"
LMAO.......you use MS Security, there's a well know oxymoron. The scum installed WHILE I was downloading, and unzipping, the Logons. The scum is contained in one of the zipped files. I see that, instead of checking the problem, your IT people chastise people for reporting such things.
Xupiter does not work on a time delay, it runs at the next bootup/restart. As I have ActiveX controls disabled, it cannot install on my system. Additionally, it installs as an IE toolbar....NOT a standalone active desktop utility.
Seems you need to learn to read what people report........not assume that they are stupid and you are 'Holier Than Thou'.
Thanks for nothing
Stardock Support wrote:
Dear Sir,
None of the skin files contain executables, so it is not possible
that it came from our site. However, if you had recently been
surfing the next, you most likely ran into a web site that did not
protect themselves against Xupiter, which is spyware which will
download and install on your computer from an infected web site
usually on a time delay. We use all current MS internet securities
that safeguard us from such attacks.
Thank you,
Angie
On Wed, 15 Jan 2003 11:42:22 -0500, Stardock General Information
wrote:
>==================BEGIN FORWARDED MESSAGE==================
>>Return-path:
>>Received: from web12402.mail.yahoo.com ([216.136.173.129])
>> by stardock.com ([127.0.0.1])
>> with SMTP (MDaemon.PRO.v6.0.3.R)
>> for ; Wed, 15 Jan 2003 10:57:27 -0500
>>Message-ID:
>>Received: from [24.129.45.113] by web12402.mail.yahoo.com via HTTP; Wed, 15 Jan 2003 08:00:44 PST
>>Date: Wed, 15 Jan 2003 08:00:44 -0800 (PST)
>>From: Doyle
>>Subject: scumware
>>To: [email protected]
>>MIME-Version: 1.0
>>Content-Type: multipart/alternative; boundary="0-1469653529-1042646444=:7431"
>>X-MDRcpt-To: [email protected]
>>X-MDRemoteIP: 216.136.173.129
>>X-Return-Path: [email protected]
>>X-MDaemon-Deliver-To: [email protected]
>
>
>
>
>Last night, while downloading Logons, for Stardock's LogonStudio(TM), at least one of them installed scumware on my system. Specifically, an active
>desktop componant which was a large 'Search toolbar' style piece of scumware. Took me almost 2 hours to track this slime down, and turn it off (Registry,
>Run) I've yet to find the scumware so I can delete it. IF you bother to find and remove the file(s) containing this slime, I would greatly appreciate being
>advised on how to find and remove the scumware that installed on my system.
>
>Thank you, Doyle aka Citizen d1g3r4t1
 |
|
Page 6 of 12 | |
|
|---|
kthxbye
Reply #102 Thursday, January 16, 2003 10:12 PM
Reply #102 Thursday, January 16, 2003 10:12 PM
Actually - no. Not a bit of evidence points here.
I went back through the list again - and the one .logonxp file which is on /your/ list, but is not to be found in the Wincustomize library is:
LCARS2.logonxp 117.78Kb A 12/21/2002 10:14:42 PM
Nooooow - judging from the sheer number of logons you downloaded which are dated 1/15/2003 - it's fairly safe to say that those would be the ones were refering to in the original email...
... yet! This one's dated 12/21/2002 - sooooo - it wouold not have been one of the ones you downloaded the other night, correct?
I went back through the list again - and the one .logonxp file which is on /your/ list, but is not to be found in the Wincustomize library is:
LCARS2.logonxp 117.78Kb A 12/21/2002 10:14:42 PM
Nooooow - judging from the sheer number of logons you downloaded which are dated 1/15/2003 - it's fairly safe to say that those would be the ones were refering to in the original email...
... yet! This one's dated 12/21/2002 - sooooo - it wouold not have been one of the ones you downloaded the other night, correct?
citats
Reply #103 Thursday, January 16, 2003 10:12 PM
Reply #103 Thursday, January 16, 2003 10:12 PM
If the file has not been found ... hmmmm just maybe its not HERE. your starting to sound like a scratched phonograph.
d1g3r4t1
Reply #104 Thursday, January 16, 2003 10:24 PM
Reply #104 Thursday, January 16, 2003 10:24 PM
Nope, grabbed them all here......I would surmise file date was altered by the scumware.....one of many such tactics employed such software.
citats
Reply #105 Thursday, January 16, 2003 10:27 PM
Reply #105 Thursday, January 16, 2003 10:27 PM
d1g3r4t1? You've gotta be joking? wheres the punch line? 
d1g3r4t1
Reply #106 Thursday, January 16, 2003 10:29 PM
Reply #106 Thursday, January 16, 2003 10:29 PM
This should probably be under a different thread.....but as far as E-mail, even private between 2 friends is not private. Can you say Carnivore? Legally, E-mail is considered, in the U.S. at least, as no more private than a postcard....which can be read by anyone who handles it.
This became even less of a privacy issue, in the fallout of 9/11.
This became even less of a privacy issue, in the fallout of 9/11.
WOM
Reply #107 Thursday, January 16, 2003 10:30 PM
Reply #107 Thursday, January 16, 2003 10:30 PM
d1g3r4t1, you are sounding like an educated newbie, but you've been here almost as long as I have. What set you off? Have a bad day or something?
goodmorphing
Reply #108 Thursday, January 16, 2003 10:32 PM
hmmmm I have been struggling to remember why this conversation sounded so familiar. Something about trying to prove the absence of a presence, something about the hostility, something about the troops gathering, something about the inevitability of it all, the futility.... the accusations, the mistrust....
Oh yeah, the evening news... that's why this sounds so familiar....
Reply #108 Thursday, January 16, 2003 10:32 PM
hmmmm I have been struggling to remember why this conversation sounded so familiar. Something about trying to prove the absence of a presence, something about the hostility, something about the troops gathering, something about the inevitability of it all, the futility.... the accusations, the mistrust.... Oh yeah, the evening news... that's why this sounds so familiar....
d1g3r4t1
Reply #109 Thursday, January 16, 2003 10:36 PM
Reply #109 Thursday, January 16, 2003 10:36 PM
>How's your Internet 'History' looking? Can we see a list of the last couple of dozen sites visited PRIOR to your 'problem' or would that be 'too revealing'?.
After the mess with Micro$loths 'secret files' garbage was discovered with the release of Windows 95, all such info (History/cookies/files/off-line files) is scrubbed daily. Currently using 'Spider' to delete the secret index.dat files, daily......much easier than tracking down and deleting them through DOS as we used to have to do.
After the mess with Micro$loths 'secret files' garbage was discovered with the release of Windows 95, all such info (History/cookies/files/off-line files) is scrubbed daily. Currently using 'Spider' to delete the secret index.dat files, daily......much easier than tracking down and deleting them through DOS as we used to have to do.
JamMeister33
Reply #110 Thursday, January 16, 2003 10:37 PM
Reply #110 Thursday, January 16, 2003 10:37 PM
This is absolutely the stupidest thread I have ever read on this message board.
Why is anyone wasting their valuable time arguing with this person?
Why is anyone wasting their valuable time arguing with this person?
goodmorphing
Reply #111 Thursday, January 16, 2003 10:42 PM I am guessing because there is passion on both sides? I don't know about anyone else, but I don't usually carry on an argument with someone if I can see they don't care at all...
I can be that stubborn if I think I am right... you guys just haven't seen me like that. It's there, though. I can understand it.
Reply #111 Thursday, January 16, 2003 10:42 PM
I am guessing because there is passion on both sides? I don't know about anyone else, but I don't usually carry on an argument with someone if I can see they don't care at all... I can be that stubborn if I think I am right... you guys just haven't seen me like that. It's there, though. I can understand it.
d1g3r4t1
Reply #112 Thursday, January 16, 2003 10:42 PM
Reply #112 Thursday, January 16, 2003 10:42 PM
Cause they got caught with their pants down and are trying to CYA
citats
Reply #113 Thursday, January 16, 2003 10:43 PM
Reply #113 Thursday, January 16, 2003 10:43 PM
If your clearing your "(History/cookies/files/off-line files) is scrubbed daily." d1g3r4t1 why is it you manage to have the "history" of your downloads and all the dates pertaining to this ghost hunt...
goodnight.
goodnight.
crissy14
Reply #114 Thursday, January 16, 2003 10:49 PM
Reply #114 Thursday, January 16, 2003 10:49 PM
Ive been following this coversation for a while now. I cant believe you guys are still at it. Kiss and make up 
kthxbye
Reply #115 Thursday, January 16, 2003 10:56 PM
Reply #115 Thursday, January 16, 2003 10:56 PM
Actually, dierati, there's no 'CYA' required with me, as there's no 'A' that needs covering, since I'm not associated with Stardock or Wincustomize in any way shape or form outside of happily giving them money and spending far too much time /here/.
... Gads, no - I can't even continue, because I can't keep a straight face about it anymore when I go back up to your replies about all of this. Look back at your own list of files that you've given - only about half of them are dated the 15th - the simple fact of the matter is, the one .logonxp theme may or may not have come from here - but either way you didn't get it last night - and either way, all you still seem to have to say is "an unknown program from an unknown archive did something because I didn't pay attention."
I've done my part, I've done beyond my part in fact, I checked every one of the files, despite knowing fairly certainly that it hadn't come from one of them, and proved there was nothing wrong with them - time t'move on, nothing more to see here.
... Gads, no - I can't even continue, because I can't keep a straight face about it anymore when I go back up to your replies about all of this. Look back at your own list of files that you've given - only about half of them are dated the 15th - the simple fact of the matter is, the one .logonxp theme may or may not have come from here - but either way you didn't get it last night - and either way, all you still seem to have to say is "an unknown program from an unknown archive did something because I didn't pay attention."
I've done my part, I've done beyond my part in fact, I checked every one of the files, despite knowing fairly certainly that it hadn't come from one of them, and proved there was nothing wrong with them - time t'move on, nothing more to see here.
kthxbye
Reply #116 Thursday, January 16, 2003 10:58 PM
Reply #116 Thursday, January 16, 2003 10:58 PM
Crissy - I get bored when I'm job hunting. ^_~
goodmorphing
Reply #117 Thursday, January 16, 2003 11:03 PM
Reply #117 Thursday, January 16, 2003 11:03 PM
Citizen kthxbye - I'll write you job recommendatins...
goes above and beyond duty
is persistent
confrontational as needs be
has no need to 'CYA' nor 'CHA' either (that may get you some juicy job offers)
goes above and beyond duty
is persistent
confrontational as needs be
has no need to 'CYA' nor 'CHA' either (that may get you some juicy job offers)
IPlural
Reply #118 Thursday, January 16, 2003 11:08 PM
Reply #118 Thursday, January 16, 2003 11:08 PM
logitech mouseware has a dll in it that is actually spyware. benn shipping in there software for a long time now.
I'll look up the name of the dll if anyone is interested in it and also the link to the site with the information of the exact spyware it is.
actually it ships with a lot of retail software where people are interested in your browsing habit and such to build sales dbf's and also sell to data-warehaouses.
I'll look up the name of the dll if anyone is interested in it and also the link to the site with the information of the exact spyware it is.
actually it ships with a lot of retail software where people are interested in your browsing habit and such to build sales dbf's and also sell to data-warehaouses.
citats
Reply #119 Thursday, January 16, 2003 11:16 PM
Reply #119 Thursday, January 16, 2003 11:16 PM
probably backweb... its the first thing I killed after installing my Logitech mouse. It supposed to update your software but does more then that.
wombat_1
Reply #120 Thursday, January 16, 2003 11:26 PM
Reply #120 Thursday, January 16, 2003 11:26 PM
"It" is still ranting .... "Troll" is one term that might be appropriate.
Weird thought, one Logon has eluded the people who seem to be wasting their time in an attempt to clear up an apparently fictitious problem, the Troll can't remember and despite his security efforts but has 'retained'(as noted above) the history of his downloads ...... maybe (call me a cynic) someone is just stirring the pot for the sake of it, perhaps one with too much time on his hands and nothing more creative to do.
And all that aside, for one so anal retentive on the issue of security, why D/L 30 logons and "unzip" them in one hit?
Even this dumb Wombat checks out zip files for anything odd before opening one up, let alone a heap of them.
Good intentions? A warning message? BOLLOCKS! >
Weird thought, one Logon has eluded the people who seem to be wasting their time in an attempt to clear up an apparently fictitious problem, the Troll can't remember and despite his security efforts but has 'retained'(as noted above) the history of his downloads ...... maybe (call me a cynic) someone is just stirring the pot for the sake of it, perhaps one with too much time on his hands and nothing more creative to do.
And all that aside, for one so anal retentive on the issue of security, why D/L 30 logons and "unzip" them in one hit?
Even this dumb Wombat checks out zip files for anything odd before opening one up, let alone a heap of them.
Good intentions? A warning message? BOLLOCKS! >
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
|
|
Page 6 of 12 | |
|
|---|
Reply #101 Thursday, January 16, 2003 10:07 PM