Xupiter Trojan Horse on this site.

[Simplicity]

I've been a lurker here for a while, but I recently
discovered that this site is hosting a Xupiter ActiveX
object that acts as a Trojan Horse. I'm interested
in getting info on games and such, but I don't think
I'm willing to risk my computer to do it.

Here's information for any of you who've been tricked
into installing this nasty program (either by clicking Yes, or by having your security settings too low):

Xupiter Info

It is my hope that the mods for this board will fix this
problem as soon as possible.

[MarkG]

Please post any info that shows that what you got actually originated from our site

A generic statement of your find doesnt help us in taking the appropriate action

[Simplicity]

I opened the Apolyton moo3 forum page, and a dialog popped up asking whether I would like to install the Xupiter ActiveX object. I didn't have any other pages open.

I knew the object was bad because I wound up actually being infected by this program at work (because my security settings were lowered there). I didn't figure out
where the object came from until I came to this site at home, and the dialog actually popped up.

It doesn't happen all of the time, so I'm assuming it's one of your advertisers... I'll try to find it if you like.

[MarkG]

could you check your browser history for a url from paypopup.com? if you find any, post them here

thank you

[Wittlich]

Xupiter/Xupiter uses the site xupiter.com for all functions; Xupiter/BrowserWise points to browserwise.com instead but is otherwise identical. There have been various updates to both versions in parallel, mostly adding extra DLLs to the 'Updates' folder.

Three times in the past week my browser's home page setting has been changed to browserwise.com. Of course everytime this has happend, I've reset my homepage and ran Ad-Aware - which found the pesty program and deleted it...of course, it's getting old having to do this every few days.

Thank God for Ad-Aware though. If I recall correctly, the programs Ad-Aware finds are called/deal with "fastclick" along with some other "click" programs

[Shnozwangler]

I have been on this site for a long time and regularly check my reg and virus info... I have not gotten this trojan horse program...

Where have you been playing... Next time wear you pocket protector!

[Simplicity]

Yep... I have one:

http://www3.paypopup.com/loading.php?id=apolyton&pop=enter&t=5&subid=3449&tid=1039717704&ref=http%3A//apolyton.net/counter.php%3Fpage%3DMoO3

[SpencerH]

I just got the Xupiter thingie. I was just coming here to complain about this since I thought it was something from one of the many pop-ups that I get here. It only asks to be installed when I'm here at poly.

I looked at my browser history and there it was:

http://www3.paypopup.com/loading.php?id=apolyton&pop=enter&t=5&subid=3449&tid=1039721326&ref=http%3A//apolyton.net/forums/forumdisplay.php%3Fs%3D%26forumid%3D163

[Simplicity]

Originally posted by Shnozwangler
I have been on this site for a long time and regularly check my reg and virus info... I have not gotten this trojan horse program...

Where have you been playing... Next time wear you pocket protector!

I've also been here a long time, and this is a pretty new
thing. But it's pretty clear (to me at least) that it came from this site. It is an ActiveX object... Are you using IE or Netscape? It would only work in IE... And then it would only work if you were foolish enough to either (a) accept it, (b) have your security settings too low, or (c) if it finds some hole in your security... (i.e. you're not running the latest IE).

[Wittlich]

I have found two on my system:

http://www3.paypopup.com/loading.php?id=apolyton&pop=enter&t=5&subid=3449&tid=1039721850&ref=http%3A//64.246.32.51/%7Eadmin1/forums/index.php

http://www3.paypopup.com/loading.php?id=apolyton&pop=enter&t=5&subid=3449&tid=1039721292&ref=http%3A//apolyton.net/forums/showthread.php%3Fs%3D%26postid%3D1530998%26t%3D5960%23post1530998

[MarkG]

thanks both for the info

I've contacted the possible source with it, and have disabled their code until i get a response

[Rasbelin]

More good reasons to visit Poly with MSIE and a pop-up killing program or by using Netscape/Mozilla.

[Lefty Scaevola]

The Xupiter appears to be comming from the once in 6 hours pop-up under the default style. See also dashi's pop up/doaload thread. Xupiter appears to have trahsed dissident's OS.

[MarkG]

update

popup provider says xupiter has been removed from our rotation and some tests of kind people on our irc channel showed it to be true

we've enabled the code again, feel free to contact us if you get anything inappropriate

thank you for your help and support

[Zopperoni]

Originally posted by Rasbelin
More good reasons to visit Poly with MSIE and a pop-up killing program or by using Netscape/Mozilla.

OPERA!!!