d1g3r4t1 d1g3r4t1

Scumware contained in some of the Logons

Scumware contained in some of the Logons

I came across some scumware, when unzipping one of the logons. I sent a message to wincustomize's IT people to advise same. THeir response was that I was stupid and didn't know what I was talking about. The exchange is appended:


Subject: Re: Fwd: scumware
To: "Stardock Support"

LMAO.......you use MS Security, there's a well know oxymoron. The scum installed WHILE I was downloading, and unzipping, the Logons. The scum is contained in one of the zipped files. I see that, instead of checking the problem, your IT people chastise people for reporting such things.

Xupiter does not work on a time delay, it runs at the next bootup/restart. As I have ActiveX controls disabled, it cannot install on my system. Additionally, it installs as an IE toolbar....NOT a standalone active desktop utility.

Seems you need to learn to read what people report........not assume that they are stupid and you are 'Holier Than Thou'.

Thanks for nothing



Stardock Support wrote:


Dear Sir,
None of the skin files contain executables, so it is not possible
that it came from our site. However, if you had recently been
surfing the next, you most likely ran into a web site that did not
protect themselves against Xupiter, which is spyware which will
download and install on your computer from an infected web site
usually on a time delay. We use all current MS internet securities
that safeguard us from such attacks.

Thank you,
Angie

On Wed, 15 Jan 2003 11:42:22 -0500, Stardock General Information
wrote:

>==================BEGIN FORWARDED MESSAGE==================
>>Return-path:
>>Received: from web12402.mail.yahoo.com ([216.136.173.129])
>> by stardock.com ([127.0.0.1])
>> with SMTP (MDaemon.PRO.v6.0.3.R)
>> for ; Wed, 15 Jan 2003 10:57:27 -0500
>>Message-ID:
>>Received: from [24.129.45.113] by web12402.mail.yahoo.com via HTTP; Wed, 15 Jan 2003 08:00:44 PST
>>Date: Wed, 15 Jan 2003 08:00:44 -0800 (PST)
>>From: Doyle
>>Subject: scumware
>>To: [email protected]
>>MIME-Version: 1.0
>>Content-Type: multipart/alternative; boundary="0-1469653529-1042646444=:7431"
>>X-MDRcpt-To: [email protected]
>>X-MDRemoteIP: 216.136.173.129
>>X-Return-Path: [email protected]
>>X-MDaemon-Deliver-To: [email protected]
>
>
>
>
>Last night, while downloading Logons, for Stardock's LogonStudio(TM), at least one of them installed scumware on my system. Specifically, an active
>desktop componant which was a large 'Search toolbar' style piece of scumware. Took me almost 2 hours to track this slime down, and turn it off (Registry,
>Run) I've yet to find the scumware so I can delete it. IF you bother to find and remove the file(s) containing this slime, I would greatly appreciate being
>advised on how to find and remove the scumware that installed on my system.
>
>Thank you, Doyle aka Citizen d1g3r4t1
46,535 views 221 replies
Reply #76 Top
Can you say Troll?

Sure, I knew you could.

>

Powered by SkinBrowser!
Reply #77 Top
Try downloading the files in question. Some of them are zipped. Not very many, they're rather small.



In the grand scheme of things, this is the exact same sort of responses I get from IT departments, customer service, etc....whether by email or phone....if I've got a simple question or have a complaint or, as in this case, try to advise someone of a simple problem. Micro$loth being the worst offender. People assume, read the 1st 2 lines and ignore the rest, and in this thread, people jumping in with stuff when they didn't read the entire thread, etc. ad nausium. It's almost as bad government employees. And this is the first time the response has included acqusations of illigal activity. UNBELIEVABLE.

Excuse the hell out of me for giving a hoot.
Reply #79 Top
wytraven.......Someone else back in the thread brought up the porn. Not being familiar with Ware'z, outside of what I've seen reported on TechTV, I couldn't see coming here to advise about download procurred somewhere else. Furthermore, the product in question is a free one, how would warez have anything to do with it.

It was Jofo who accused me downloading warez, way back in the beginning of the thread. Why he thought Warez would have anything to do with a free product is beyond me.
Reply #80 Top
oh, wrt there not being a zip file in the list I provided. Thats because I had already unzipped the files, and deleted zipped archive. I don't know which of the files were zipped, only that there were 10 or so of them. I had already run the recycle bin through my 'Shredder' program, thus I cannot pull them back up to see the original zipped files. This is clearly stated, several times, throughout the thread.
Reply #81 Top
Okay, so I'm sitting at home. I'm bored. I've finished job hunting for the day, and I've cleaned the house.

I download every single logon from digerati's list.

Out of all of these, 1 of them I couldn't find (sorry,) and out of the remaining, 5 of them are zip files:

Cheshire, MedalofHonour, stoplogon, StrongholdLogon and XP1_Bindi

All of them contain the exact same thing inside - the apropriate logonxp file and nothing else. (Well, if you want to get technical, Cheshire and Stronghold also contain UI icons.)

Now... to solve the mystery of lunch... er... dinner.



Powered by SkinBrowser!
Reply #82 Top
hrm - if you found the run key in the registry, the data member contains the path and location of the executable.




Powered by SkinBrowser!
Reply #83 Top
Well I'll tell you what... I will defend Stardock support with every ounce of energy I have. Comparing them to practically anyone else is insulting and ignorant. They have *always* been professional, thourough and complete when I have had problems. There is another user here who had *so* many problems with his machine (not Stardock software, his personal machine) for months. Stardock folks helped him out way, way, way beyond the call of duty. They even put a switch in the Windowblinds .ini file to help him fix his hardware problems. Please don't ever talk about the quality of support here. It is, hands down, the best support I've ever seen from any kind of software, hardware, appliance, whatever, company.

Powered by SkinBrowser!
Reply #85 Top
Wolfie, if our missing emoticon was a flower, I would give it to you right here and now!
Reply #86 Top
First things first.
A private email to a company is STILL private between the sender and the recipient, irrespective of whether either is a group of individuals.....authority to read is determined by the principal of the company.

Public disclosure containing unsubstantiated allegations is called 'Libel', as it intends to defame a party.

A 'suggestion' that your 'problem' originated via warez-hunting is reasonable as I am sufficiently grown-up to know what goes on.....been there, done that....AND I'm not averse to the odd porn or two...[call me honest, here]...I fully understand the vile popups and popunders and browser hijacking that occurs, having experienced it myself many times.
The difference is that I have NEVER found the equivalent spyware or 'scum' as you call it here on Wincustomize.com or any of the other Skinning sites.

Yes, it is entirely feasible that you were elsewhere 'unsavoury' and then came here to dl, skins, etc to pretty up the warez'ed proggies. Why? Because we KNOW it happens....and there are many more proggies being skinned by works here that are NOT 'free'.

Misspell my name once more in a deliberate attempt to be a childish prat and your access rights to this site will be revoked.

Site administrators, such as KarmaGirl do not deserve their private communications aired publicly, and I don't need to waste my life dealing with a recalcitrant pain in the butt who resorts to infantile slight.

As mentioned previously, this should have been handled via direct communication with a full, clear background of cause and effect, something that COULD be acted upon.

It appears kthxbye has isolated the 'zips' from the others and STILL found nothing.

How's your Internet 'History' looking? Can we see a list of the last couple of dozen sites visited PRIOR to your 'problem' or would that be 'too revealing'?.

I await your considered response,
Yours sincerely,
Paul Martin
JAFO.......[that's J...A...F...O]
Reply #87 Top
Hey, I was just sitting around trying to motivate myself to do non-cleaning related stuff, it was nothing. ^_^

Powered by SkinBrowser!
Reply #88 Top
I leave the house for 7 hours, and come back to find this thread still at the top of the board.........
Not surprised nothing was found.
As a bonus, I find confirmation that not using WinZip is a good idea!
Reply #89 Top
Took a full 45 min. to read this thread and still came away with nothing. Does it or doesn't it. Who knows, and the saga continues.

Powered by SkinBrowser!
Reply #90 Top
Citizen d1g3r4t1

Consider the possibility that you had your browser open at the same time and like many websites out there today they try and push gator/search toolbar and others at you thru a popup script that you must click ok to activate. so you mouse went to the button you clicked and now you have a scum/spy or ware of some sort. The fact you were unzipping logon files was coincidence. Thank you for the potential warning but I advise you review the websites you visited and determin which one is running this script.

Powered by SkinBrowser!
Reply #91 Top
Wom I read page one and then skipped to the end.

Powered by SkinBrowser!
Reply #92 Top
Yeah Iben, I should have done that too. I wouldn't have missed much as everything was repeated on each page. >

Powered by SkinBrowser!
Reply #93 Top
kthxbye, if you will re-read his post, found all BUT one of the files. Thus he has NOT cleared this site. Perhaps one of you found the offending skin and removed it already.

hmmmmmmmmmmmmmmmm
Reply #95 Top
Company communications are not private. Ask any lawyer. Accuse me of downloading Warez again and "I" will have one teach you the meaning of Libel.
Reply #96 Top
Feel free to remove anything you wish. You have been invited to twice before. Not like anyone couldn't create new accounts in 30 seconds.
Reply #98 Top
*And off in the corner, in the comfy chair next to the fireplace, kthxbye sits there finally relaxing after a long pissy day of job hunting and dealing with the present snowfall scratching his head in puzzlement*

Wow, okay. Uhm... yeah. Somehow, I really doubt this. I do. No, really, I do. Now, it just seems you're convinced the problem /has/ to lie here, when in all actuality, every single little bit of evidence, points to anyplace, anything /but/ here.

Unless... it truly goes far, far deeper than this! A-ha! That is it! It's the previously unknown Wincustomize conspiracy - threatening to undermine everything we hold dear! Watson, the game is afoot!

Ahem, or not. Allow me to reiterate.. yeah, uhm, I just don't think so.

Hrm - I really need some caffeine..

Powered by SkinBrowser!
Reply #99 Top
I also meant to point out that I didn't find the one logon because I hadn't planned on devoting a large portion of my life to tracking down these evil creatures - and the downloaded file name (from the list given by digerati,) doesn't always coincide with the name of the theme itself in the library. Enh.



Powered by SkinBrowser!
Reply #100 Top
>Yes, it is entirely feasible that you were elsewhere 'unsavoury' >and then came here to dl, skins, etc to pretty up the warez'ed >proggies. Why? Because we KNOW it happens....and there are many >more proggies being skinned by works here that are NOT 'free'.

Morally and legally inexcusable