Should any of you have had the unfortunate experience to have Xupiter commandeer your IExplore, here is the fix…
www.computing.net/windows2000/ wwwboard/forum/40332.html
http://allentech.net/parasite/Xupiter.html
Parasite: Xupiter
This record last updated Tue Nov 26 2002 13:17:30
Description
Xupiter consists of an Internet Explorer toolbar containing link buttons to the search engine at xupiter.com and a task run at Windows startup which downloads updates to the software and may launch pop-ups. It also contains functionality to periodically hijack your home page and search settings to point to xupiter.com, and add links pointing to xupiter.com to your bookmarks.
Variants
Xupiter/Xupiter uses the site xupiter.com for all functions; Xupiter/BrowserWise points to browserwise.com instead but is otherwise identical. There have been various updates to both versions in parallel, mostly adding extra DLLs to the ‘Updates’ folder.
Also known as
XupiterToolbar (program name).
Distribution
Installed by ActiveX drive-by-download in affiliate pages. Known sources include the site www.freewebupgrades.com (which is advertised by junk e-mail) and pop-up adverts on sites such as FortuneCity.
What it does
Advertising
Yes. Apart from the hijacking and added links, the software will show pop-under advertisements when its controlling servers direct it to. At the time of writing, this feature does not seem to be in use.
Privacy violation
No.
Security issues
Yes. The software contacts its servers to ask for update code, which is executed without checks. It also downloads third-party software (eg. a casino loader).
Stability problems
The update-checking task tries to connect to xupiter.com to download updates whether or not you are connected. If it fails it may cause a crash in ‘RunDownload.exe’.
Removal
Xupiter has no uninstall function. Spybot S&D update 2002-09-22 and Ad-Aware reffile 042-24-09-2002 can remove it, however.
Manual removal
Open the registry (from the Start menu, click Run and enter regedit) and find the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Delete the ‘XupiterStartup’ entry.
Open a DOS command prompt window (Start->Programs->Accessories) and enter the following commands to deregister the toolbar.
cd “%WinDir%\System”
regsvr32 /u “C:\Program Files\Xupiter\Updates\XupiterToolbar.dll”
regsvr32 /u “C:\Program Files\Xupiter\Updates\XTUpdate.dll”
regsvr32 /u “C:\Program Files\Xupiter\Updates\XTSearch.dll”
(If your Program Files folder is something other than ‘C:\Program Files’ - for example because you have installed on a different drive or you are using a non-English version of Windows, you will have to change the commands accordingly. You may also not need the last line, if you have an older version of the software without the XTSearch.dll file, so do not worry if this command gives an error.)
Restart the computer and you should be able to delete the Xupiter folder in Program Files. You can now restore your home page (Internet Options->General->Home page) and your search settings (Internet Options->Programs->Reset web settings). You can also delete the registry keys HKEY_CURRENT_USER\Software\Xupiter and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{A27CFCAE-9351-4D74-BFFC-21EB19693D8C} to clean up if you wish.
Links
The Xupiter site itself is just another bog-standard portal. The toolbar was developed by them based on generic toolbar code licensed from Orion Studios (which is why this name appears on XupiterToolbar.exe).