Scumware contained in some of the Logons
Thursday, January 16, 2003 by d1g3r4t1 | Discussion: WinCustomize Talk
I came across some scumware, when unzipping one of the logons. I sent a message to wincustomize's IT people to advise same. THeir response was that I was stupid and didn't know what I was talking about. The exchange is appended:
Subject: Re: Fwd: scumware
To: "Stardock Support"
LMAO.......you use MS Security, there's a well know oxymoron. The scum installed WHILE I was downloading, and unzipping, the Logons. The scum is contained in one of the zipped files. I see that, instead of checking the problem, your IT people chastise people for reporting such things.
Xupiter does not work on a time delay, it runs at the next bootup/restart. As I have ActiveX controls disabled, it cannot install on my system. Additionally, it installs as an IE toolbar....NOT a standalone active desktop utility.
Seems you need to learn to read what people report........not assume that they are stupid and you are 'Holier Than Thou'.
Thanks for nothing
Stardock Support wrote:
Dear Sir,
None of the skin files contain executables, so it is not possible
that it came from our site. However, if you had recently been
surfing the next, you most likely ran into a web site that did not
protect themselves against Xupiter, which is spyware which will
download and install on your computer from an infected web site
usually on a time delay. We use all current MS internet securities
that safeguard us from such attacks.
Thank you,
Angie
On Wed, 15 Jan 2003 11:42:22 -0500, Stardock General Information
wrote:
>==================BEGIN FORWARDED MESSAGE==================
>>Return-path:
>>Received: from web12402.mail.yahoo.com ([216.136.173.129])
>> by stardock.com ([127.0.0.1])
>> with SMTP (MDaemon.PRO.v6.0.3.R)
>> for ; Wed, 15 Jan 2003 10:57:27 -0500
>>Message-ID:
>>Received: from [24.129.45.113] by web12402.mail.yahoo.com via HTTP; Wed, 15 Jan 2003 08:00:44 PST
>>Date: Wed, 15 Jan 2003 08:00:44 -0800 (PST)
>>From: Doyle
>>Subject: scumware
>>To: [email protected]
>>MIME-Version: 1.0
>>Content-Type: multipart/alternative; boundary="0-1469653529-1042646444=:7431"
>>X-MDRcpt-To: [email protected]
>>X-MDRemoteIP: 216.136.173.129
>>X-Return-Path: [email protected]
>>X-MDaemon-Deliver-To: [email protected]
>
>
>
>
>Last night, while downloading Logons, for Stardock's LogonStudio(TM), at least one of them installed scumware on my system. Specifically, an active
>desktop componant which was a large 'Search toolbar' style piece of scumware. Took me almost 2 hours to track this slime down, and turn it off (Registry,
>Run) I've yet to find the scumware so I can delete it. IF you bother to find and remove the file(s) containing this slime, I would greatly appreciate being
>advised on how to find and remove the scumware that installed on my system.
>
>Thank you, Doyle aka Citizen d1g3r4t1
Subject: Re: Fwd: scumware
To: "Stardock Support"
LMAO.......you use MS Security, there's a well know oxymoron. The scum installed WHILE I was downloading, and unzipping, the Logons. The scum is contained in one of the zipped files. I see that, instead of checking the problem, your IT people chastise people for reporting such things.
Xupiter does not work on a time delay, it runs at the next bootup/restart. As I have ActiveX controls disabled, it cannot install on my system. Additionally, it installs as an IE toolbar....NOT a standalone active desktop utility.
Seems you need to learn to read what people report........not assume that they are stupid and you are 'Holier Than Thou'.
Thanks for nothing
Stardock Support wrote:
Dear Sir,
None of the skin files contain executables, so it is not possible
that it came from our site. However, if you had recently been
surfing the next, you most likely ran into a web site that did not
protect themselves against Xupiter, which is spyware which will
download and install on your computer from an infected web site
usually on a time delay. We use all current MS internet securities
that safeguard us from such attacks.
Thank you,
Angie
On Wed, 15 Jan 2003 11:42:22 -0500, Stardock General Information
wrote:
>==================BEGIN FORWARDED MESSAGE==================
>>Return-path:
>>Received: from web12402.mail.yahoo.com ([216.136.173.129])
>> by stardock.com ([127.0.0.1])
>> with SMTP (MDaemon.PRO.v6.0.3.R)
>> for ; Wed, 15 Jan 2003 10:57:27 -0500
>>Message-ID:
>>Received: from [24.129.45.113] by web12402.mail.yahoo.com via HTTP; Wed, 15 Jan 2003 08:00:44 PST
>>Date: Wed, 15 Jan 2003 08:00:44 -0800 (PST)
>>From: Doyle
>>Subject: scumware
>>To: [email protected]
>>MIME-Version: 1.0
>>Content-Type: multipart/alternative; boundary="0-1469653529-1042646444=:7431"
>>X-MDRcpt-To: [email protected]
>>X-MDRemoteIP: 216.136.173.129
>>X-Return-Path: [email protected]
>>X-MDaemon-Deliver-To: [email protected]
>
>
>
>
>Last night, while downloading Logons, for Stardock's LogonStudio(TM), at least one of them installed scumware on my system. Specifically, an active
>desktop componant which was a large 'Search toolbar' style piece of scumware. Took me almost 2 hours to track this slime down, and turn it off (Registry,
>Run) I've yet to find the scumware so I can delete it. IF you bother to find and remove the file(s) containing this slime, I would greatly appreciate being
>advised on how to find and remove the scumware that installed on my system.
>
>Thank you, Doyle aka Citizen d1g3r4t1
 |
|
Page 9 of 12 | |
|
|---|
goodmorphing
Reply #162 Sunday, January 19, 2003 2:35 PM
Maybe a new poll.... how many are boss kind of people and how many are not.
Reply #162 Sunday, January 19, 2003 2:35 PM
Maybe a new poll.... how many are boss kind of people and how many are not.
paxx
Reply #163 Sunday, January 19, 2003 2:40 PM
Reply #163 Sunday, January 19, 2003 2:40 PM
Goodmorphing: women bosses had to be twice as ferocious and tough as any man in order to get there. That's why most women bosses are... hum... tough. 
(anybody remembers Margaret Thatcher?)
(anybody remembers Margaret Thatcher?)
d1g3r4t1
Reply #164 Monday, January 20, 2003 6:26 PM
Reply #164 Monday, January 20, 2003 6:26 PM
Submitted for everyone's general edification.
I've done some legwork and found a bit of info on the Scumware in question.
It was written by superwebsearch.com, and is spread through downloads. It changes the windows configuration to enable Active Desktop, and installs a Search Bar ON THE DESKTOP, without first asking permission. It also changes the IE default search to http://www.superwebsearch.com/ie/
It's listed as adi.dll
Not being an activeX component, it slides right past spyblaster and AnalogX's Script Defender. It also slid past Norton Anti-virus while it was installing. Neither Spybot nor Ad-aware recognize it.
Currently, I'm trying to get removal instructions from superwebsearch. They are NOT very forthcoming. Their initial response was just how to turn it off.
I performed a registry search on superwebsearch. Found a number of entries. Deleted each.
I've waited 2 days. No further response from superwebsearch.
I've done some legwork and found a bit of info on the Scumware in question.
It was written by superwebsearch.com, and is spread through downloads. It changes the windows configuration to enable Active Desktop, and installs a Search Bar ON THE DESKTOP, without first asking permission. It also changes the IE default search to http://www.superwebsearch.com/ie/
It's listed as adi.dll
Not being an activeX component, it slides right past spyblaster and AnalogX's Script Defender. It also slid past Norton Anti-virus while it was installing. Neither Spybot nor Ad-aware recognize it.
Currently, I'm trying to get removal instructions from superwebsearch. They are NOT very forthcoming. Their initial response was just how to turn it off.
I performed a registry search on superwebsearch. Found a number of entries. Deleted each.
I've waited 2 days. No further response from superwebsearch.
d1g3r4t1
Reply #165 Monday, January 20, 2003 6:35 PM
Reply #165 Monday, January 20, 2003 6:35 PM
The telecommunications act, is written to protect the basic rights of Americans from Police or Government entities.
Communications, between anyone/entity and a company are public.
Between individuals, these items are governed by the laws of each state. (Linda Tripp found this out the hard way)
Even then, communication interception is subject of debat. I'll use the FBI's Carnivore, as an example.
The FBI's Offical Carnivor Page http://www.fbi.gov/hq/lab/carnivore/carnivore.htm
The 'Stop Carnivor' people http://stopcarnivore.org/what_is_carnivore.htm
The ACLU's Records regarding Carnivor http://archive.aclu.org/news/2000/n072400a.html
Email Privacy discussion, with lotso links http://www.cpsr.org/publications/newsletters/issues/2000/Fall2000/caftori-teicher.html
Communications, between anyone/entity and a company are public.
Between individuals, these items are governed by the laws of each state. (Linda Tripp found this out the hard way)
Even then, communication interception is subject of debat. I'll use the FBI's Carnivore, as an example.
The FBI's Offical Carnivor Page http://www.fbi.gov/hq/lab/carnivore/carnivore.htm
The 'Stop Carnivor' people http://stopcarnivore.org/what_is_carnivore.htm
The ACLU's Records regarding Carnivor http://archive.aclu.org/news/2000/n072400a.html
Email Privacy discussion, with lotso links http://www.cpsr.org/publications/newsletters/issues/2000/Fall2000/caftori-teicher.html
d1g3r4t1
Reply #166 Monday, January 20, 2003 7:00 PM
Reply #166 Monday, January 20, 2003 7:00 PM
Jafo, I neither departed the scene, nor succumbed.......there was a weekend.
As I've managed to find out what, and where, the scum came from....the nature of which negates all of your arguements, I suppose I'm still incompetent, eh?
As I've managed to find out what, and where, the scum came from....the nature of which negates all of your arguements, I suppose I'm still incompetent, eh?
KenLin
Reply #167 Monday, January 20, 2003 8:34 PM
Reply #167 Monday, January 20, 2003 8:34 PM
hmm. I didn't realize you had figured out where it came from. Where was it?
Before answering, remember that it was not from 'some unknown logonxp on this site'
Before answering, remember that it was not from 'some unknown logonxp on this site'
kthxbye
Reply #170 Monday, January 20, 2003 10:59 PM
Reply #170 Monday, January 20, 2003 10:59 PM
Wow - personally I'm surprised this thread's still going! 
Yup - that's all I've got to say - the Absolut's kicking a bit harder - than normal tonight! Oh - except to state again to tazzy and Jafo (around #155, 156,) "Enh.. I was bored"?
Yup - that's all I've got to say - the Absolut's kicking a bit harder - than normal tonight! Oh - except to state again to tazzy and Jafo (around #155, 156,) "Enh.. I was bored"?
messybuu
Reply #172 Monday, January 20, 2003 11:38 PM
Reply #172 Monday, January 20, 2003 11:38 PM
I see that d1g3r4t1 found the culprit. Did he admit that he was wrong yet about his assumption that it came from a Logon file, and that Stardock was right in their first message to him?
KarmaGirl
Reply #174 Tuesday, January 21, 2003 12:00 PM
Reply #174 Tuesday, January 21, 2003 12:00 PM
by going to superwebsearch the page of it says how to uninstall it (how is that not forthright?) http://superwebsearch.com/uninstall.php
(don't see how their support is that bad.....)
But, doing a bit of research myself (because I'm just that type of person) I have found that the company that actually makes that program makes "browserart"
http://www.browserart.com/
If you hit the "download" link, it will download it even if you cancel it. If you hit "yes" then it installs.
None of this has anything to do with WinCustomize, though.....still no connection.....
(don't see how their support is that bad.....)
But, doing a bit of research myself (because I'm just that type of person) I have found that the company that actually makes that program makes "browserart"
http://www.browserart.com/
If you hit the "download" link, it will download it even if you cancel it. If you hit "yes" then it installs.
None of this has anything to do with WinCustomize, though.....still no connection.....
paxx
Reply #175 Tuesday, January 21, 2003 12:43 PM
Reply #175 Tuesday, January 21, 2003 12:43 PM
KarmaGirl, I don't mean to contradict you, but the guy's right about the uninstall link: it doesn't tell you how to uninstall, but only how to disactivate it from your desktop (although the header wrongfully reads "uninstall").
KarmaGirl
Reply #176 Tuesday, January 21, 2003 1:38 PM
Reply #176 Tuesday, January 21, 2003 1:38 PM
It doesn't matter, the point is, it still doesn't link anything to this site. The files have been downloaded and checked, and nobody else has come in contact with the "scumware". The point of this whole thread is that there is a "scumware" on WC. There is still no proof to that. The only thing that he has shown is that he has somehow installed something that he doesn't know how to uninstall.
IPlural
Reply #178 Tuesday, January 21, 2003 5:10 PM
Reply #178 Tuesday, January 21, 2003 5:10 PM
I still think chugging huge big can of " grow up " is in order.
stark23x
Reply #179 Tuesday, January 21, 2003 5:40 PM
Reply #179 Tuesday, January 21, 2003 5:40 PM
I call bullshit.
Guess where one place is where that search app gets downloaded?
Cracks.am (and other sites listed through Astalavista.) My bet is d1g3r4t1 here is pirating software, as was discussed in the beginning of this debacle.
Guess where one place is where that search app gets downloaded?
Cracks.am (and other sites listed through Astalavista.) My bet is d1g3r4t1 here is pirating software, as was discussed in the beginning of this debacle.
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
|
|
Page 9 of 12 | |
|
|---|
Reply #161 Sunday, January 19, 2003 2:25 PM