12-12-2002 22:58									#1
	Xupiter Trojan Horse on this site. Increase the size of your Attachments

I've been a lurker here for a while, but I recently
discovered that this site is hosting a Xupiter ActiveX
object that acts as a Trojan Horse. I'm interested
in getting info on games and such, but I don't think
I'm willing to risk my computer to do it.

Here's information for any of you who've been tricked
into installing this nasty program (either by clicking Yes, or by having your security settings too low):

Xupiter Info

It is my hope that the mods for this board will fix this
problem as soon as possible.

	12-12-2002 23:14									#2
	Suffering from ads?

Please post any info that shows that what you got actually originated from our site

A generic statement of your find doesnt help us in taking the appropriate action

	12-12-2002 23:17									#3
	Browse Apolyton AD-FREE

I opened the Apolyton moo3 forum page, and a dialog popped up asking whether I would like to install the Xupiter ActiveX object. I didn't have any other pages open.

I knew the object was bad because I wound up actually being infected by this program at work (because my security settings were lowered there). I didn't figure out
where the object came from until I came to this site at home, and the dialog actually popped up.

It doesn't happen all of the time, so I'm assuming it's one of your advertisers... I'll try to find it if you like.

	12-12-2002 23:35									#4
	Suffering from ads?

could you check your browser history for a url from paypopup.com? if you find any, post them here

thank you

	12-12-2002 23:46									#5
	Browse Apolyton AD-FREE

quote: Xupiter/Xupiter uses the site xupiter.com for all functions; Xupiter/BrowserWise points to browserwise.com instead but is otherwise identical. There have been various updates to both versions in parallel, mostly adding extra DLLs to the 'Updates' folder.

Three times in the past week my browser's home page setting has been changed to browserwise.com. Of course everytime this has happend, I've reset my homepage and ran Ad-Aware - which found the pesty program and deleted it...of course, it's getting old having to do this every few days.

Thank God for Ad-Aware though. If I recall correctly, the programs Ad-Aware finds are called/deal with "fastclick" along with some other "click" programs

	12-12-2002 23:48									#6
	Support Apolyton buy from Amazon

I have been on this site for a long time and regularly check my reg and virus info... I have not gotten this trojan horse program...

Where have you been playing... Next time wear you pocket protector!

	12-12-2002 23:49									#7
	Help yourself to an AD-FREE life

Yep... I have one:

http://www3.paypopup.com/loading.php?id=apolyton&pop=enter&t=5&subid=3449&tid=1039717704&ref=http%3A//apolyton.net/counter.php%3Fpage%3DMoO3

	12-12-2002 23:54									#8
	Browse Apolyton AD-FREE

I just got the Xupiter thingie. I was just coming here to complain about this since I thought it was something from one of the many pop-ups that I get here. It only asks to be installed when I'm here at poly.

I looked at my browser history and there it was:

http://www3.paypopup.com/loading.ph...26forumid%3D163

	12-12-2002 23:55									#9
	Support Apolyton buy from Amazon

quote: Originally posted by Shnozwangler I have been on this site for a long time and regularly check my reg and virus info... I have not gotten this trojan horse program... Where have you been playing... Next time wear you pocket protector!

I've also been here a long time, and this is a pretty new
thing. But it's pretty clear (to me at least) that it came from this site. It is an ActiveX object... Are you using IE or Netscape? It would only work in IE... And then it would only work if you were foolish enough to either (a) accept it, (b) have your security settings too low, or (c) if it finds some hole in your security... (i.e. you're not running the latest IE).

	12-12-2002 23:59									#10
	Help yourself to an AD-FREE life

I have found two on my system:

http://www3.paypopup.com/loading.ph...orums/index.php

http://www3.paypopup.com/loading.ph...t153
0998

	13-12-2002 00:03									#11
	Get a bigger avatar today!

thanks both for the info

I've contacted the possible source with it, and have disabled their code until i get a response

	13-12-2002 01:11									#12
	Browse Apolyton AD-FREE

More good reasons to visit Poly with MSIE and a pop-up killing program or by using Netscape/Mozilla.

	13-12-2002 01:19									#13
	Support Apolyton or Terrorists Win

The Xupiter appears to be comming from the once in 6 hours pop-up under the default style. See also dashi's pop up/doaload thread. Xupiter appears to have trahsed dissident's OS.

	13-12-2002 04:09									#14
	Support Apolyton buy from Amazon

update

popup provider says xupiter has been removed from our rotation and some tests of kind people on our irc channel showed it to be true

we've enabled the code again, feel free to contact us if you get anything inappropriate

thank you for your help and support

	13-12-2002 06:36									#15
	Enter the AD-FREE zone

quote: Originally posted by Rasbelin More good reasons to visit Poly with MSIE and a pop-up killing program or by using Netscape/Mozilla.

OPERA!!!

	13-12-2002 07:47									#16
	Support Apolyton, pre-order Civilization IV

Thanks for looking into this Markg

yes Xupiter was what I accidently put on my system. I hate clutter. I'm almost obsessive about that . I like to keep my system free from clutter. When I tried to remove this Xupiter I ran into problems with my windows explorer. A hard drive wipe took care of that .

	13-12-2002 08:06									#17
	Full PM-box? Change here!

MarkG

FYI

I have this URL from paypoup - 66.227.36.231

I logged on to forum approx 9:10PM CST

	14-12-2002 11:25									#18
	Popups Put an end to popups!

Markos: What, if any, popups get served to logged in users on a regular basis? I have regular hits to paypopup.com and thought that you had gone to serving popups to logged in users. I've turned off popups in Opera now so I won't be getting them anymore. I can probide URLs if you need. I don't seem to have been infected with this Xupiter parasite though.

	14-12-2002 13:37									#19
	Full PM-box? Change here!

Thanks for bringing this up, guys! I had this crap on my PC as well!

	14-12-2002 15:06									#20
	Support Apolyton, buy GURPS/ Alpha Centauri

quote: What, if any, popups get served to logged in users on a regular basis?

logged in users have always goten popups, just like non logged in(guests)

are you saying that you got to many of them(e.g. one at every page)? if this happened, you should make sure cookies are enabled

	14-12-2002 17:52									#21
	Increase Your PM Length

I havent seen the Xupiter again yet, it was pretty rare for me to see it though. What I am getting a lot of is a page fault (I dunno if thats really what it is) that has

UUUUUUUUUUUUUUUUUUUUUUUUU

at the top and nothing else.

	14-12-2002 21:47									#22
	Get a bigger avatar today!

quote: Originally posted by MarkG [q]if this happened, you should make sure cookies are enabled

Even with cookies enabled and auto log on, the time/date utility pop up thats come from the "system tray update" banner ad pop ups every page that it is on. I now have 4 time/date utility popup windows on, after veiwing just 6 pages.

	14-12-2002 23:07									#23
	Inflate your Upload Space

Let's see, even though I have a pop-up blocker, I get a IE browser icon on my system tray from xupiter (It starts as xupiter.com then switches the name Pop-under). When I click on it no browser window pops up, but when I try to right-click close it the comptuer freakin' freezes. And that sucks on a laptop since I can't just pull the plug and restart. I need to wait for 2 hours for the BIOS to see that the battery is almost dead and kill the power.


Here are a few links I found in the history page.

http://www2.paypopup.com/loading.ph...ums%26group%3D2

http://www1.paypopup.com/loading.ph...ums%26group%3D2

I have a screenshot of my systemtray to show you what I mean. On the far right is that xupiter thing.

Attachment: xupiter2.gif
This has been downloaded 72 time(s).

	14-12-2002 23:32									#24
	Enter the AD-FREE zone

quote: Even with cookies enabled and auto log on, the time/date utility pop up thats come from the "system tray update" banner ad pop ups every page that it is on.

Lefty, these popups unfortunately come from the RealMedia ads that american visitors get. This is actually a ad that we have already asked for it's removal, since the advertised utilities when installed also include Gator.

To avoid it, please use a special or ultra special style.

More details in the faq
http://apolyton.net/forums/misc.php...faq&page=10#154

	14-12-2002 23:38									#25
	Get a bigger avatar today!

quote: Let's see, even though I have a pop-up blocker, I get a IE browser icon on my system tray from xupiter (It starts as xupiter.com then switches the name Pop-under).

Thrawn, the paypopup.com popups are first titled(or it's title start with) paypopup and then change to the advertiser title. What you describe sounds like you're infected with Xupiter. The solution is to download Adaware
http://www.lavasoftusa.com/downloads.html

	15-12-2002 00:44									#26
	Support Apolyton, buy Galactic Civilizations

i am going to run adaware now, and let you know my findings......

	15-12-2002 01:43									#27
	Help yourself to an AD-FREE life

i forgot to come back and let you know, NO virus or trojan on my computer from this site...

instead i had something called ***tracker :/

anyways, not sure how i got that one

	15-12-2002 02:01									#28
	Full PM-box? Change here!

quote: Originally posted by MarkG quote: Even with cookies enabled and auto log on, the time/date utility pop up thats come from the "system tray update" banner ad pop ups every page that it is on. Lefty, these popups unfortunately come from the RealMedia ads that american visitors get. This is actually a ad that we have already asked for it's removal, since the advertised utilities when installed also include Gator. To avoid it, please use a special or ultra special style.

I'm using default ultra special. I've gotten the Xupiter download twice.

	15-12-2002 02:02									#29
	Support Apolyton, buy Civilization: The Boardgame

actually i found something else when i logged on to poly, and i deleted whatever it was, in my windows downloaded programs file....

at least the website detected it when i logged on

	15-12-2002 02:06									#30
	Tired of ads?

quote: I've gotten the Xupiter download twice.

it's two different things. What Lefty described is not Xupiter.

did you get the Xupiter ad after 12.Dec.02 23:00 gmt?