Home
Terms & Definitions
Parasites List
Categories
Threat Level
Contact Us
Spyware Information
Name: Xupiter
Threat Level:
Category: Adware
Aliases: XupiterToolbar

Variants: Xupiter/Xupiter uses the site xupiter.com for all functions; Xupiter/Xjupiter is the same but uses xjupiter.com instead. Xupiter/2003 is the same as the Xupiter variant, but puts its DLL directly in its Program Files folder instead of in an 'Updates' folder.

Xupiter/BrowserWise points to browserwise.com but is still otherwise identical to Xupiter. Xupiter/Browser is a newer variant which still points to browserwise.com, but stores its program files in a folder called 'Browser' instead of 'Xupiter'.

Xupiter/Sqwire is a newer variant pointing at sqwire.com. Its program files are stored in a 'Sqwire' folder, in a different layout to previous versions, and an installer DLL is left in Downloaded Program Files.

Xupiter/OrbitExplorer is the latest variant, pointing at orbitexplorer.com. Some of its program files are stored in an 'Orbit' folder in Program Files, the rest in an 'OE' folder in Common Files. It also has the installer DLL.


Spyware Characteristics
Description: Xupiter consists of an Internet Explorer toolbar containing link buttons to the search engine at xupiter.com and a task run at Windows startup which downloads updates to the software and may launch pop-ups. It also contains functionality to periodically hijack your home page and search settings to point to xupiter.com, and add links pointing to xupiter.com to your bookmarks.

Properties:
  • Show advertisments
  • Makes changes to browser settings
  • Connects to the internet by itself

What it does?
Advertising: Yes, Apart from the hijacking and added links, the software periodically opens pop-under advertisements as directed by its controlling servers.

Privacy violation: The privacy policy states that the software may track all web usage. However this behaviour has not been observed.

Security issues: Yes, The software contacts its servers to ask for update code, which is executed without checks. It has also been known to download third-party software.

Stability problems: In the initial variants, the update-checking task tries to connect to xupiter.com to download updates whether or not you are connected. If it fails it may cause a crash in 'RunDownload.exe'. Some versions of Xupiter can cause the Windows Explorer to crash when opened under Windows XP.

Method of infection
Installed by ActiveX drive-by-download in affiliate pages. Known sources include the site www.freewebupgrades.com (which is advertised by junk e-mail) and pop-up adverts on sites such as FortuneCity and cjb.net subdomains.

More recently also bundled with Grokster.

One of Xupiter/Sqwire's ActiveX drive-by-download pages has been advertised by junk e-mail (spam) offering a 'Free Christian Toolbar'.


Removal Instructions
bulletproofsoft.com "Spyware Remover" is the best tool for the removal of this spyware.

Links
Site: http://www.xupiter.com/

http://www.browserwise.com/

http://www.sqwire.com/

http://www.orbitexplorer.com/