XUPITER browser hijacking 4

[cbarrol]

While surfing on the net a program called XUPITER hijacked my Internet Explorer. When I cleaned it off my system (Win2KPro) My blue e (The internet explorer icon) disappeared with it. The importance of the icon was that you could right click on it and setup all of your internet properties, while you cannot do that with the shortcut on the taskbar or the one in \ProgramFiles\InternetExplorer. Anybody know how to restore this other than uninstalling and reinstalling IE?
Thanks.

 

[Fisheye]

Did this "Xupiter" get by Anti Virus and Firewall settings undetected? I have not heard of this problem;Is that how you detected there was a problem,by noticing the blue I.E. icon missing.And are you also Win2k warby12?

 

[cbarrol]

For anyone who comes across this BS program, here are some removal instructions I got off MCAfee's site: (and yes it got by McAfee because it is not classified as a virus, just "unwanted software&quot

Manual Removal
This program can be removed by following the instructions below.
1 -Open the registry from the Start menu, click Run and type “regedit”. Then find the keys:
HKEY_CURRENT_USER\Software\ and remove the Xupiter value.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and remove the Xupiter entry.
HKEY_LOCAL_MACHINE\Software\Microsoft\Search and find the SearchAssistant value. Right click, select “Modify” and type in your original homepage.
HKEY_LOCAL_MACHINE\Software\Microsoft\Main and find the SearchBar value. Right click, select “Modify” and type in your original homepage.
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main and find the Start Page value. Right click, select “Modify” and type in your original homepage.
You can now close the Registry.
2- Delete the Xupiter folder under C:\Program Files (use Explorer).

3- Restart your computer.

 

[carrr]

You needn't go through all these gyrations to get Zupiter off your machine. Ad-Aware and SpyBot both clean it handily without monkeying in your registry:

http://www.lavasoftusa.com/

http://spybot.eon.net.au/

Programs like this don't simultaneously attach themselves to your pc. You let them on. Some are more covert than others, but most latch on when you, in a moment of weakness, click yes to download some garbage-ware or the other. If it's not an overt download, it can be bundled with something else that seems innocuous. Better read the fine print.

 

[jeffbouldin]

Actually from the link that warby12 provided it says "Installed by ActiveX drive-by-download in affiliate pages. Known sources include the site

http://www.freewebupgrades.com

(which is advertised by junk e-mail) and pop-up adverts on sites such as FortuneCity."

So if you don't have prompt selected for all your ActiveX settings in IE{Tools/Internet Options/Security/Highlite Internet/Click Custom Level) then it could load itself.

Jeff

 

[carrr]

Good point jeffbouldin. This points out the (rather unfortunate) need to keep up one's defenses against sleazy marketing parasites....

 

[Fisheye]

Good work jeffbouldin!No wonder I couldn't find it on the Norton website.I should have been searching under "Very Deadly Computer Parasites";hehehe.......Thx,Cheers!