A Digital Age Deserves A Digital Leader

I have the parasite Xupiter- help

I have the parasite Xupiter- help

Postby Joni » Sat May 10, 2003 10:19 pm

Found this info when closing browser after server said it had run into problem and had to close.
Xupiter Startup MFC Application Xupiter start up 2003.exe
Files C;\docum\Locals~.\JoanJo~1.DF2 or Z\Locals~temp\
WER7B.tmp.dir00\appcompat.txt

Since I picked up this parasite I've received so much junk mail for pornographic sites which I certainly don't want. What can I do to get rid of it. Help me please! :question :question Joni
Don't let your alligator mouth overload your hummingbird "butt"

Image
PROfessional Member
User avatar
Posts: 666
Joined: Sun Jul 14, 2002 6:22 pm
Location: Arizona
Real Name: Joan Johnston

Postby Joni » Sat May 10, 2003 10:21 pm

Forgot to say I'm running Windows xp home version with SP1 on board.
Thanks
Don't let your alligator mouth overload your hummingbird "butt"

Image
PROfessional Member
User avatar
Posts: 666
Joined: Sun Jul 14, 2002 6:22 pm
Location: Arizona
Real Name: Joan Johnston

Postby dlt » Sat May 10, 2003 10:43 pm

Hi...try using a spyware remover like Ad-Aware
or Spybot
I am extraordinary, I am just your ordinary
average every day sane psycho supergoddess
~Liz Phair, Extraordinary~
PROfessional Member
User avatar
Posts: 705
Joined: Mon Mar 11, 2002 11:56 am
Location: New England, USA

Postby Joni » Sat May 10, 2003 11:05 pm

I was under the impression that this is a parasite and can't be removed from my computer using your advice. I'm a fairly new dummy to this site and need things spelled out simply. How do I get these programs? Thanks for answering. Joni
Don't let your alligator mouth overload your hummingbird "butt"

Image
PROfessional Member
User avatar
Posts: 666
Joined: Sun Jul 14, 2002 6:22 pm
Location: Arizona
Real Name: Joan Johnston

Postby SCgone » Sat May 10, 2003 11:22 pm

Joni, here's what I have on it. It's what a lot of people call a "drive-by downloader"

Open the registry (from the Start menu, click Run and enter regedit) and find the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Delete the 'XupiterStartup' entry in the Right Hand pane.

Also delete the following Registry Keys:

HKEY_CURRENT_USER\Software\Xupiter
HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units\{A27CFCAE-9351-4D74-BFFC-21EB19693D8C}

Reboot, and delete the entire Program Files\Xupiter directory.

You're also likely to have a Xupiter ActiveX object in your Downloaded Program Files folder. Find that one, rightclick it, and choose properties. It has the following ID: {A27CFCAE-9351-4D74-BFFC-21EB19693D8C}

Now rightclick the file, and choose delete.

Next, delete the Xupiter folder in Program Files.

Finally, go to Internet Options/Programs, and hit "Reset Web Settings".
PRO PLATINUM
Posts: 6879
Joined: Thu Mar 14, 2002 11:59 pm
Location: South Carolina, USA

Postby Joni » Sat May 10, 2003 11:42 pm

Thanks Bob, will do this. Will take a while as printer out of ink, will have to copy instructions by hand. Had the weirdest thing happen after posting last entry. Computer, browser, went crazy. Got message again that browser or service had encountered a problem and had to close. Internet explorer kept loading up to 40+ times. Couldn't delete or close any programs. Things were opening all over the screen. Finally was able after about 3 min. to shut computer down safely. Forgot how to shut down computer with use of 3 keys like shift, alt and ????? I'm still shaking in my boots hoping it doesn't happen again. Could Xupiter be the problem?
Joni
Don't let your alligator mouth overload your hummingbird "butt"

Image
PROfessional Member
User avatar
Posts: 666
Joined: Sun Jul 14, 2002 6:22 pm
Location: Arizona
Real Name: Joan Johnston

Postby SCgone » Sun May 11, 2003 12:04 am

Yes it could be. It hijacks your browser. Right click on the taskbar and bring up the Task Manager. You can close it from there.
PRO PLATINUM
Posts: 6879
Joined: Thu Mar 14, 2002 11:59 pm
Location: South Carolina, USA

Postby *Starz* » Sun May 11, 2003 12:12 am

Sounds like it Joni...Moved your thread to this forum as it is more appropriate here.

Hang in there...If your computer will cooperate try copy & paste to get this page onto your computer...then you could keep two windows open while working until it is time to reboot...this will allow you to look at your directions as you need them...then you won't have to handwrite so many of the directions down...Good Luck

Bell...I'm assuming that she can leave a second window open while in the registry...please correct me if I am wrong...Thanks
[align=center]Image

~ You Are Never Given A Wish Without Being Given The Power To Make It Come True ~[/align]
PRO Level 16
User avatar
Posts: 1893
Joined: Sat Aug 17, 2002 1:05 am
Location: Great Smoky Mountains

Postby Joni » Sun May 11, 2003 12:25 am

Just got out of registry, have question. Did the beginning of Bob's answer. Found HKEY etc okay. Under current version on right hand side it shows default only with type SZ and (value not set) BUT has another one right under current version on left side named internet settings. This one shows both default setting plus Proxy enable type REG DWORD Data 0x00000000(0) on right side
current version shows default only. Is the one )Proxy) the one to delete?
Don't let your alligator mouth overload your hummingbird "butt"

Image
PROfessional Member
User avatar
Posts: 666
Joined: Sun Jul 14, 2002 6:22 pm
Location: Arizona
Real Name: Joan Johnston

Postby SCgone » Sun May 11, 2003 12:55 am

Joni, I wouldn't delete that one. Try the rest, but now that one until I take a look at it. Also, the last time I checked AdAware wouldn't work on this one, but if it's been updated it may now. That would make it easier.
Starz, I thought about moving it, but I don't consider this a trojan or virus, but whatever..
PRO PLATINUM
Posts: 6879
Joined: Thu Mar 14, 2002 11:59 pm
Location: South Carolina, USA

Next

Return to Security & Virus

Who is online

Users browsing this forum: No registered users and 0 guests

cron
cron