Xupiter.com taking over explorer home page?

[DomeBase]

Hi Folks,

For some reason, Xupiter keeps reappearing as my homepage when I active explorer, although I never asked it to be my homepage and have reset my homepage elsewhere... it comes back. Is this something malicious? Makes me wonder if it is doing anything else that I do not want. Have any of you have any experience with this site or any advice? Thanks,

Registrant:
Xupiter.com Inc.
15445 Ventura Blvd Suite 318
Sherman Oaks, ca 91403
US

Registrar: Dotster (http://www.dotster.com)
Domain Name: XUPITER.COM
Created on: 31-MAY-02
Expires on: 31-MAY-03
Last Updated on: 31-MAY-02

Administrative Contact:
reg, dom [email protected]
Xupiter.com Inc.
15445 Ventura Blvd Suite 318
Sherman Oaks, ca 91403
US
000 000 0000
000 000 0000

 

[dtobias]

Dump the Microsoft browser and use another browser such as Mozilla or Opera; they're much less vulnerable to being "hacked" by malicious sites.

 

[Omni]

Or use regedit and remove anything related to Xupiter. Done it once it worked.
[edit] I should add, do it at your own risk [/edit]

 

[DomeBase]

thanks!

 

[Who-Wiz]

From SpyWareInfo.com
http://www.spywareinfo.com/yabbse/index.php?board=3;action=display;threadid=1066;start=0

Xupiter is something I installed thinking it was a plugin needed to see a web page. It was certified so I trusted. It hijacked my computer.

First, I disabled its tool bar from the browser and returned the internet settings to my fav start page, but next time I opened a browser window xupiter would be the start page again.

Then I tried to uninstall Xupiter from the control panel, but I did not find it there. Therefore, I went to www.xupiter.com and tried to use their uninstall link. It did nothing.

So, I tried to erase its directory but a .dll, XTUPDATE, is not deletable as it's always in use by windows. From there on there's always a message appearing each time I try to open an explorer or iexplorer window. The message is "Xupiter Toolbar is not installed properly, please resinstall..." I even wanted to reinstall but there is no link provided in the site.

Following the instructions to remove programs that run themselves at start-up on cexx.org/startup, I removed the reference to the Xupiter thing from a -Run entry in the system Registry, but the messages continued appearing.

Then I found, using msinfo32 Software Environment/32Bits Loaded Modules, that the XTUPDATE.DLL is there.
So I looked for all other references of Xupiter or XTUPDATE on the system Registry and I found it suscribed as a class and as a library under HKEY_CLASSES_ROOT and HKEY_LOCAL_MACHINE\Software\CLASSES (I guess there is even a looping reference), and as the default search bar for the HKEY_CURRENT_USER and HKEY_USERS\DEFAULT. It's also referenced under HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units.

I'm attaching a file where all Register entries found were copied.

Could someone tell me please, what should I do now?

Patricia.

There's a NASTY amount of these "installs" on "domain parked" websites. I was shocked (not as much as many others I'm sure) when Register.com starting doing this. I mean... man. I'm sure apps like Kazaa install many of this horrible www.ScumWare products. To find out more, go to ScumWare.com.

W|Z

 

[Who-Wiz]

Hm.