what's with this xupiter crap?

What you have there is spyware and is nothing to do with any other proggy. Get Ad-Aware and it will get rid of that and any other spyware you may have.
http://www.lavasoft.nu/index.html is the place to get it

There is another thread with the removal instructions. Perhaps someone can post that here.

THere are several registry keys to eliminate and an activex before you can delete the Xuipter folder.

Follow the instructions and don't try to remove it uninstructed because it will screw up your search in IE if not removed properly.

If anyone can please provide the link to where the removal instructions are located, I'd greatly appreciate it. Stinking, rotten, miserable Xupiter installed itself on my PC a few days ago after linking to some ambiguous website. It has nothing to do with WinCustomize or Stardock.

Perhaps if I can provide a bit more info, some of the more tech savvy folks out there may be able to help as well...

I DO have AdAware and I used it after the Xupiter installed itself. The uninstall program provided by Xupiter did NOTHING -- not even a response to a double click. An email to Xupiter was quickly returned -- "mailbox full." Problem being... I was so uptight about it I used RegEdit and deleted every stinking reference from the Registry. The offensive program is now gone, but I have a blank space when I right click any toolbar. The space is available to be checked as a toolbar option, but nothing happens since the program is gone.

In short, (sorry, I know it wasn't too short), what I need are the valid, default Registry keys for Explorer toolbars (IE is part of Explorer, and the Xupiter flub affects ALL toolbars). My system is fine, but it bugs me to no end to have that stupid blank space leftover. I'd like to just have the standard Windows default toolbar options (and Google, of course -- gotta have Google).

Many thanks in advance. Even a few suggestions on where to find a list of Registry keys would be terrific. MS Knowledge Base is of no help, and sadly, Google searches aren't, either.

Scruffy...I found and posted the instructions after a five minute search on Google....was 'easy as'....but that thread is a way back....I'll see if I can dig it up...

3 by Jafo - 1/2/2003 8:19:52 AM
A 2 minute search found me these instructions for removing the spyware....

Open the registry (from the Start menu, click Run and enter regedit) and find the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Delete the 'XupiterStartup' entry in the Right Hand pane.

Also delete the following Registry Keys:

HKEY_CURRENT_USER\Software\Xupiter
HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units\{A27CFCAE-9351-4D74-BFFC-21EB19693D8C}

Reboot, and delete the entire Program Files\Xupiter directory.

You're also likely to have a Xupiter ActiveX object in your Downloaded Program Files folder. Find that one, rightclick it, and choose properties. It has the following ID: {A27CFCAE-9351-4D74-BFFC-21EB19693D8C}

Now rightclick the file, and choose delete.

Next, delete the Xupiter folder in Program Files.

Finally, go to Internet Options/Programs, and hit "Reset Web Settings".

This program seems very invasive. I wonder if there's a good way of preventing it in the first place?

Reboot, and delete the entire Program Files\Xupiter directory

I wonder about this because after you reboot the darn Xuipter dll file will put the registry keys back. I think delete and then reboot.

Probably either way is fine....

I did a search in regedit for Xuipter and deleted all entries but left the program folder.

I then later discovered they were back in the registry.

A bit of advice: I didn't use the instructions but used CTRL F and F3 in regedit and in the process screwed up the search in IE. Follow the yellow brick road because the damage is not repairable even with a reinstall of IE.

Yikes. I also used F3 within Regedit and had a field day deleting the references. What I did is delete an essential key by mistake, thereby leaving the blank, but checkable toolbar option. The good news for me is that I use only Google's search bar, and it functions the same as always, even after the blunder.

Thanks much for providing the pertinent registry keys. Possibly I didn't find the info on the web using Google because I refused to type "Xupiter" into the search window, fearing a rogue link to some site that would install it AGAIN. I did try every other possibly keyword combination, though!

I'll let you know if I can clear the problem with the provided fix. Regardless, my browser is none the worse for wear. Sincerely appreciate the above advice. Not a lazy fellow here; I don't mind doing some research to fix a problem, but it seemed fruitless.

Everyone hold hands and sing together, now: "We won't support spyware..."

Makes you think, Xuipter lists only a few keys to delete and I recall many more. I checked each key I deleted and everyone had Xuipter in it. I do the same with AOL and haven't had problems deleting the million AOL puts in the registry and I don't have AOL or AIM.

A quick THANKS once again to everyone who helped out. The demon Xupiter has been vanquished.

See ya'll around.

http://www.bulletproofsoft.com/ This is the one I run....


two words : Spy Watch


Monitor Started!


3:15:17 AM Warning! Gator Key detected: HKEY_CLASSES_ROOT\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\

3:15:17 AM Warning! Gator Key detected: HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\

3:15:17 AM Warning! Wurld Media Key detected: HKEY_CLASSES_ROOT\Interface\{3CB6DEF9-1DB2-4B5D-9A70-9BF8345ED73C}\

3:15:17 AM Warning! Wurld Media Key detected: HKEY_CLASSES_ROOT\Mbho.IEHlprObj\

3:15:17 AM Warning! Wurld Media Key detected: HKEY_CLASSES_ROOT\Mbho.IEHlprObj.1\

3:15:17 AM Warning! Wurld Media Key detected: HKEY_CLASSES_ROOT\TypeLib\{4769DD43-4045-405C-945F-752516445E89}\

3:15:17 AM Warning! Other Cookie detected: john@bfast[2].txt

3:15:17 AM Warning! HitBox Cookie detected: [email protected][2].txt

3:15:17 AM Warning! HitBox Cookie detected: john@hitbox[1].txt

3:15:17 AM Warning! Doubleclick Cookie detected: john@doubleclick[1].txt

3:15:17 AM Warning! Lop.com Cookie detected: [email protected][1].txt

3:15:17 AM Warning! ClickFinders Cookie detected: john@S005-01-8-30-216258-100254[1].txt

3:15:17 AM Warning! Hitslink Cookie detected: [email protected][2].txt

3:15:17 AM Warning! Avenue A Inc Cookie detected: john@atdmt[2].txt

3:16:17 AM Warning! Gator Key detected: HKEY_CLASSES_ROOT\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\

3:16:17 AM Warning! Gator Key detected: HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\

It gets them all and it does it real time....

Next we'll be de-worming j/k!

What is the hitslink cookie? I see that comes from Wincustomize. Is it the message icon thing?

There are a couple cookies. One deals with your "history" on Stardock (like the "folder" icons and such), the other (iirc) is your logon info. Both will recreate themselves, so if you are paranoid and clean them everyday, the worst that will happen is that you lose your history on the page and have to log in each time (both are really convenience features).

This is from TechTV (on preventing future Xupiter "takeovers"):

Once you remove Xupiter from your system, make sure you never install the ActiveX control again.

In Internet Explorer, click Tools and choose Internet Options.

Go to the Security tab, click the Restricted Sites icon, and then the Sites button.

Under "Add this Web site to the zone:" type xupiter.com and click Add.

Add other sites that have ActiveX controls similar to Xupiter. We recommend Gator.com and Comet Cursor.
Click OK.

You won't be prompted to download ActiveX controls from these sites ever again.

Hope that helps!
smooches,
» Phy³ . . .