d1g3r4t1 d1g3r4t1

Scumware contained in some of the Logons

Scumware contained in some of the Logons

I came across some scumware, when unzipping one of the logons. I sent a message to wincustomize's IT people to advise same. THeir response was that I was stupid and didn't know what I was talking about. The exchange is appended:


Subject: Re: Fwd: scumware
To: "Stardock Support"

LMAO.......you use MS Security, there's a well know oxymoron. The scum installed WHILE I was downloading, and unzipping, the Logons. The scum is contained in one of the zipped files. I see that, instead of checking the problem, your IT people chastise people for reporting such things.

Xupiter does not work on a time delay, it runs at the next bootup/restart. As I have ActiveX controls disabled, it cannot install on my system. Additionally, it installs as an IE toolbar....NOT a standalone active desktop utility.

Seems you need to learn to read what people report........not assume that they are stupid and you are 'Holier Than Thou'.

Thanks for nothing



Stardock Support wrote:


Dear Sir,
None of the skin files contain executables, so it is not possible
that it came from our site. However, if you had recently been
surfing the next, you most likely ran into a web site that did not
protect themselves against Xupiter, which is spyware which will
download and install on your computer from an infected web site
usually on a time delay. We use all current MS internet securities
that safeguard us from such attacks.

Thank you,
Angie

On Wed, 15 Jan 2003 11:42:22 -0500, Stardock General Information
wrote:

>==================BEGIN FORWARDED MESSAGE==================
>>Return-path:
>>Received: from web12402.mail.yahoo.com ([216.136.173.129])
>> by stardock.com ([127.0.0.1])
>> with SMTP (MDaemon.PRO.v6.0.3.R)
>> for ; Wed, 15 Jan 2003 10:57:27 -0500
>>Message-ID:
>>Received: from [24.129.45.113] by web12402.mail.yahoo.com via HTTP; Wed, 15 Jan 2003 08:00:44 PST
>>Date: Wed, 15 Jan 2003 08:00:44 -0800 (PST)
>>From: Doyle
>>Subject: scumware
>>To: [email protected]
>>MIME-Version: 1.0
>>Content-Type: multipart/alternative; boundary="0-1469653529-1042646444=:7431"
>>X-MDRcpt-To: [email protected]
>>X-MDRemoteIP: 216.136.173.129
>>X-Return-Path: [email protected]
>>X-MDaemon-Deliver-To: [email protected]
>
>
>
>
>Last night, while downloading Logons, for Stardock's LogonStudio(TM), at least one of them installed scumware on my system. Specifically, an active
>desktop componant which was a large 'Search toolbar' style piece of scumware. Took me almost 2 hours to track this slime down, and turn it off (Registry,
>Run) I've yet to find the scumware so I can delete it. IF you bother to find and remove the file(s) containing this slime, I would greatly appreciate being
>advised on how to find and remove the scumware that installed on my system.
>
>Thank you, Doyle aka Citizen d1g3r4t1
46,538 views 221 replies
Reply #151 Top
Nervously, Jafo prays that 'Action Jay' is an unattached nubile wench, but knows deep down that it's just a Manager from McDonalds with a nerd fetish....
Reply #153 Top
Awwww....... a bonding moment!
Reply #155 Top
I just want to commend Paxx. Good for you to be the grownup and stick to whatever the facts are. You sound like you are genuinly trying to communicate in here. It's too bad the other two aren't trying to give this more of a go. I'm curious to understand what happened without all the bantering between the two.
Reply #156 Top
tazzy....what 'happened without all the bantering between the two' was one went to great lengths to determine whether there was any truth to the allegations while the other painted himself further into a corner of incompetence, where the only 'out' was to depart the scene.
Either that or he has succumbed to his highly advanced and honed computing skills which he was at pains to assert but failed to demonstrate.
In spite of his acrimonious attitude, I resisted exiling him as 'some' would see that as the 'soft' solution.
Reply #157 Top
We get these kind of threads all the time. Good thing he didn't say it was a windowblind. I guess it's time for another this site sucks thread. Someone must be getting close to their cap.

Powered by SkinBrowser!
Reply #158 Top
"This site sucks" threads seem to get way too much attention.

on the other hand...

"This site rocks" threads seem to get very few replies. Maybe a couple who agree, another couple who say thanks, and then it's forgotten.

Why do we allow ourselves to get sucked in to these negative threads?
Reply #159 Top
Maybe it's the competitive confrontational nature of man.

Powered by SkinBrowser!
Reply #160 Top
#159 by Sir WOM - 1/19/2003 10:40:40 AM
Maybe it's the competitive confrontational nature of man.




Maybe that what keep woman away......
Reply #161 Top
Could be GM, but in the last 10 years I've worked for 2 women bosses. Let me tell you they were not intimidated by any man. I'am used to seeing and working for strong forceful women. Maybe thats why I can't really buy that.

Powered by SkinBrowser!
Reply #162 Top
Maybe a new poll.... how many are boss kind of people and how many are not.
Reply #163 Top
Goodmorphing: women bosses had to be twice as ferocious and tough as any man in order to get there. That's why most women bosses are... hum... tough.

(anybody remembers Margaret Thatcher?)
Reply #164 Top
Submitted for everyone's general edification.

I've done some legwork and found a bit of info on the Scumware in question.
It was written by superwebsearch.com, and is spread through downloads. It changes the windows configuration to enable Active Desktop, and installs a Search Bar ON THE DESKTOP, without first asking permission. It also changes the IE default search to http://www.superwebsearch.com/ie/
It's listed as adi.dll

Not being an activeX component, it slides right past spyblaster and AnalogX's Script Defender. It also slid past Norton Anti-virus while it was installing. Neither Spybot nor Ad-aware recognize it.

Currently, I'm trying to get removal instructions from superwebsearch. They are NOT very forthcoming. Their initial response was just how to turn it off.

I performed a registry search on superwebsearch. Found a number of entries. Deleted each.

I've waited 2 days. No further response from superwebsearch.
Reply #165 Top
The telecommunications act, is written to protect the basic rights of Americans from Police or Government entities.

Communications, between anyone/entity and a company are public.

Between individuals, these items are governed by the laws of each state. (Linda Tripp found this out the hard way)

Even then, communication interception is subject of debat. I'll use the FBI's Carnivore, as an example.
The FBI's Offical Carnivor Page http://www.fbi.gov/hq/lab/carnivore/carnivore.htm
The 'Stop Carnivor' people http://stopcarnivore.org/what_is_carnivore.htm
The ACLU's Records regarding Carnivor http://archive.aclu.org/news/2000/n072400a.html
Email Privacy discussion, with lotso links http://www.cpsr.org/publications/newsletters/issues/2000/Fall2000/caftori-teicher.html
Reply #166 Top
Jafo, I neither departed the scene, nor succumbed.......there was a weekend.

As I've managed to find out what, and where, the scum came from....the nature of which negates all of your arguements, I suppose I'm still incompetent, eh?
Reply #167 Top
hmm. I didn't realize you had figured out where it came from. Where was it?

Before answering, remember that it was not from 'some unknown logonxp on this site'
Reply #169 Top
I'm afraid to click that link.
Reply #170 Top
Wow - personally I'm surprised this thread's still going! ^_^

Yup - that's all I've got to say - the Absolut's kicking a bit harder - than normal tonight! Oh - except to state again to tazzy and Jafo (around #155, 156,) "Enh.. I was bored"?

Powered by SkinBrowser!
Reply #172 Top
I see that d1g3r4t1 found the culprit. Did he admit that he was wrong yet about his assumption that it came from a Logon file, and that Stardock was right in their first message to him?

Powered by SkinBrowser!
Reply #174 Top
by going to superwebsearch the page of it says how to uninstall it (how is that not forthright?) http://superwebsearch.com/uninstall.php
(don't see how their support is that bad.....)

But, doing a bit of research myself (because I'm just that type of person) I have found that the company that actually makes that program makes "browserart"
http://www.browserart.com/
If you hit the "download" link, it will download it even if you cancel it. If you hit "yes" then it installs.

None of this has anything to do with WinCustomize, though.....still no connection.....

Reply #175 Top
KarmaGirl, I don't mean to contradict you, but the guy's right about the uninstall link: it doesn't tell you how to uninstall, but only how to disactivate it from your desktop (although the header wrongfully reads "uninstall").