Somehow this evil webpage has been taking over my internet. Everytime open explorer it makes itself my homepage, even after i switch it back to my normal one. This website is driving me insane, i dont even know where it came from. Any time i try to go to ANY webpage xupiter will try to take over and take me to their page. What in the world can i do to delete this page from existance in my life?!?! HELP ME!

Laura

[rkselby98]

This is how you fix it.

http://www.rselby.com/Windows.html#xp27

But first you must get ride of it.


Ad-Ware Checks and removes spyware
http://www.spychecker.com/download.html

SWAT a free trojan program and free updates for life.
http://lockdowncorp.com/bots/downloadswatit.html


PC Cillion is an online free virus checker
http://housecall.antivirus.com/housecall/start_corp.asp

[TonyKlein]

It might or might not be something targeted by Ad-Aware, but it would be nice if we could have a look at your startups:

Go to Start/run, and type Msinfo32, followed by OK.
Go to Software Environment/Startup Programs.
Click Edit/'Select all', and then 'copy'
Now paste the contents in your post.

[ronhum]

Holy Cow! I see what you mean by this Xupiter bar thing. My computer has been hijacked also. It keeps carrying me back to the Xupiter site, and my internet is acting strange. When I open the msn site, random words start typing into the search blank all by them selves!

I have tried to get rid of it, but can't. I have never seen anything like this. sheesh.

Any more help with this appreciated.

[ronhum]

Here is some of the weird things that are happening. When I tried to type in a post subject just now, weird random characters started appearing on their own, and are even trying to appear now! while I am typing in this box!

Here is the startup

AdaptecDirectCD "c:\program files\roxio\easy cd creator 5\directcd\directcd.exe" All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe c:\winnt\system32\ctfmon.exe BARDOCK\Katie HKU\S-1-5-21-1487682723-1260927497-516276246-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe c:\winnt\system32\ctfmon.exe BARDOCK\Dad HKU\S-1-5-21-1487682723-1260927497-516276246-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
desktop desktop.ini NT AUTHORITY\SYSTEM Startup
desktop desktop.ini BARDOCK\Katie Startup
desktop desktop.ini BARDOCK\Dad Startup
desktop desktop.ini .DEFAULT Startup
desktop desktop.ini All Users Common Startup
GWMDMMSG gwmdmmsg.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Hot Key Kbd 9910 Daemon sk9910dm.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HPAiODevice(hp psc 700 series) - 1 c:\progra~1\hewlet~1\aio\hppsc7~1\bin\hpobrt07.exe -deviceid 1029987300 All Users Common Startup
Jet Detection c:\program files\creative\sbaudigy\program\adgjdet.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
KaZaA Media Desktop c:\program files\kazaa\kazaa.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Keyboard Preload Check c:\oemdrvrs\keyb\preload.exe /devid: /class:keyboard /runvalue:"keyboard preload check" All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
LVCOMS c:\program files\common files\logitech\qcdriver\lvcoms.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MSMSGS "c:\program files\messenger\msmsgs.exe" /background BARDOCK\Katie HKU\S-1-5-21-1487682723-1260927497-516276246-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MSMSGS "c:\program files\messenger\msmsgs.exe" /background BARDOCK\Dad HKU\S-1-5-21-1487682723-1260927497-516276246-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NAV Agent c:\progra~1\norton~1\navapw32.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NvCplDaemon rundll32.exe nvqtwk,nvcpldaemon initialize All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PROMon.exe promon.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Share-to-Web Namespace Daemon c:\program files\hewlett-packard\hp share-to-web\hpgs2wnd.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
UpdReg c:\winnt\updreg.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WINDVDPatch cthelper.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Yahoo! Pager c:\progra~1\yahoo!\messen~1\ypager.exe -quiet BARDOCK\Katie HKU\S-1-5-21-1487682723-1260927497-516276246-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
--

Any help in this bizaree problem appreciated!!the

[diver165]

very annoying indeed.... I hate when things take over my computer. Somehow this xupiter thing got by me too. Here is the uninstall that I used to get rid of it.

http://www.xupiter.com/uninstall/

Follow the instructions and you should be fixed.



Roger

hey there,
while browsing through my computer i found that xupiter had put itself in my program files so i just deleted it outta there and i have been fine ever since! Thank you so much for your help... xupiter is definitly a doosie!!!!

laura

[catskat]

I have tried the uninstall on this hijacking site and now every time I try to go to the browser or change sites I get a popup that says "xupiter is not installed properly, please reinstall"!!?? I have found it in the program files but can not delete it from there. I used to get the message that the source file may be in use, now I get the above mentioned message. I can't delete, I can't uninstall, I keep losing my homepage (of my work computer) to this trash. Isn't there anything to get it completely off my system????

[brendandonhu]

Im surprised AdAware didnt take care of it. If you boot into DOS and delete the program files from there it may take out some important parts of the software and fix things. Im about to set my security settings to high and check out that web site to see what it says.

[ronhum]

Well I finally got rid of the Xupiter web page. I ran the ad remove program, and the uninstall.

However, there is still a problem I believe may have been picked up at the same time.

When I open IE, there are random words, dots, etc. generated in the search Window, as if a ghost is typing.

If I go to another, site such as Yahoo, the same thing. And it would even type in this box I am typing in if I were on the infected computer.

Insterestingly, Norton will not detect anything, and I also ran a program designed to remover bots and trojans, and it did not find anything.

Any body have any ideas?

Though it took a while, i successfully got rid of Xupiter a few days ago... one of the problems mentioned above was that Xupiter wouldn't delete because it was "running." I found that if any internet is running, for example: my internet explorer wasn't open, but it was running, i had to ctrl alt delete and close out of all internet programs. Then Xupiter was shut out of my computer, so i could successfully delete it out of my program files!!!

-Laura
PS~ Make sure that xupiter is completely out of your program files as well as out of the temp internet files!!!

[parevalo]

I found, using msinfo32 Software Environment/32Bits Loaded Modules, that the XTUPDATE.DLL is there.

XTUPDATE.DLL, which I guess is the responsible for the message "Xupiter Toolbar is not installed properly, please resinstall..." that appears every time I open an explorer or iexplorer window, is the file installed with Xupiter under Program Files which is not possible to delete 'cause Windows is always using it.

I tried to find it under msinfo32 Software Environment/Startup Programs, as TonyKlein recommended, but it was not there.

Following the instructions to remove programs that run themselves at start-up on http://cexx.org/startup.htm, referred by Rick Selby in his page under "Getting rid of unwanted ... from your computer", I removed the reference to the Xupiter thing from a -Run entry in the system Registry, but the messages continued appearing.

So I looked for all other references of Xupiter or XTUPDATE on the system Registry and I found it suscribed as a class and as a library under HKEY_CLASSES_ROOT and HKEY_LOCAL_MACHINE\Software\CLASSES (I guess there is even a looping reference), and as the default search bar for the HKEY_CURRENT_USER and HKEY_USERS\DEFAULT.

It's also referenced under HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units.

I'm attaching a file where all Register entries found were copied.

Could someone tell me please, what should I do now?

Patricia.

[TonyKlein]

If you find it in HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units, you're likely to have a Xupiter ActiveX object in your Downloaded Program Files folder.

Take a look, spot anything (un)likely there, rightclick it, and choose 'remove'.

You might also want to download BHODemon, launch the program, and tell us what BHOs it detects.

[catskat]

YEAH- it's finally gone. Had the same problems of toolbar not being installed, not being able to delete because it was running, etc. Finally went into the command prompt, changed the name of the files, deleted them and then restarted the computer. It seems to be gone, at least until I hit the web page that has the redirect connected to it again. I am keeping my fingers crossed it doesn't happen. Wish they would get nuked!!!

[parevalo]

I found a damaged Xupiter ActiveX object {A27CFCAE-9351-4D74-BFFC-21EB19693D8C} in the Downloaded Program Files folder. When removing it, a message appeared saying there was not enought information and that I should try via the control panel. However the entry was removed.

BHODemon detects the XTUPDATE BHO.
Number:0
CLSID:{2662BDD7-05D6-408F-B241-FF98FACE6054}
DLL Path: C:\ARCHIVOS DE PROGRAMA\XUPITER\UPDATES\XTUPDATE.DLL
Satus: New
More details in the attached file.

I disabled it, and now I'll try to reboot.