PC Fear Factor: Official Xupiter Spyware Page

Eleven months ago I was diagnosed with stage 4 colon cancer. I am pleased to report that I am feeling better although the long term prognosis is not good.

If you would like to make a small contribution towards my medical expenses (insurance only covers so much), you can do so by clicking on the appropriate DONATE button below:

Note: I am overwhelmed at the generosity of others. Many have give $10.00 contributions and one person went to the trouble of clicking on the $10.00 button five times to give me a $50.00 contribution. I never envisioned this when I set up the donation buttons. I have also received two contributions in the mail for $100 each. Incredible. Whether you give $1.00 or $100.00, your donation is deeply appreciated. God bless you all. If you prefer to mail a contribution, please send it to:

Fly me to the moon and let me play among the stars. Let me see what spring is like on Xupiter and Mars.

Every once in a while, a threat emerges on the Internet that is so pervasive that it deserves a special web page on the PC Fear Factor web site. Such is the case with Xupiter, a piece of spyware that is running rampant on the web, infecting millions of computers.

For those of you who are unfamiliar with the term, spyware is software that is installed on your computer without your knowledge and permission for some nefarious purpose. For a more through discussion of the differences between adware and spyware, see PC Fear Factor.

Xupiter, like Gator, is spyware that can be installed on your computer without your knowledge if your Internet security settings are not set correctly. It can be installed when you visit a web site or click on an advertising link. Applications that install in this manner are also referred to as "drive-by downloads." (This term was probably derived from a similar term, "drive-by hacking", which describes a practice hackers employ to hack into wireless networks. In the case of spyware, the term "drive-by" is figurative; in the case of hackers, the term is literal.)

Xupiter is a browser plug-in that gets installed automatically on your computer when you visit certain web sites. There is no comprehensive list of dangerous web sites of which I am aware. A pop up ad can also install Xupiter on your computer.

Xupiter is downloaded to your computer as an Active-X control. An Active-X control is a small program or "applet" that lives on the Internet. For more information on Active-X controls, click here.

Once installed on your computer, Xupiter launches annoying pop up / pop under ads when you surf the net. It also periodically hijacks your home page, adds links to your bookmarks, and adds a tool bar to your Internet browser.

Xupiter is a threat to your privacy as it tracks your browsing habits and reports this information to a central ad server.

Xupiter has no removal function, that is, it is not a program that you can remove through the Windows Add / Remove programs function. Anti-virus software cannot detect or remove Xupiter, because it is not a virus.

Certainly, if you are experiencing any of the behaviors described above, you have reason to suspect that Xupiter has been installed on your computer. But the easiest way to determine if you have been "Xupiterized" is to check your list of Startup items in the system configuration utility. (Note: this utility does not exist if you are using Windows 2000.)

Go to Start / Run, type in msconfig and click OK. Click on the Startup tab. Scroll down the list. If you see XupiterToolbarLoader on your startup list, you have been Xupiterized:

You can uncheck it to keep it from loading, but that does not remove it from your computer.

Read Alan Luber's monthly column, Defensive Computing, in Smart Computing Magazine. Alan is also a feature writer for Smart Computing.

Another way to find out if you have been Xupiterized is to have a firewall like ZoneAlarm installed on your computer. Although a firewall cannot prevent Xupiter from being installed on your computer, it can detect the software immediately after it has been installed. ZoneAlarm monitors outbound communications between your computer and the Internet, as well as inbound communications. When a new program tries to access the Internet for the first time, ZoneAlarm pops up a program alert to ask you if you want the program to have permission to access the Internet. You will receive such an alert when Xupiter tries to access the Internet. For many people, this will be the first indication that they have been Xupiterized.

The reason that ZoneAlarm cannot prevent Xupiter from being installed on your computer is that it is installed as a legitimate response to a communication that you initiated with a web site, and firewalls only stop "conversations" initiated from outside your computer.

Be careful in your selection of firewalls. Microsoft's Internet Connection Firewall, which comes bundled with Windows XP, will not detect Xupiter because it does not monitor outbound communications.

Read our review of Cyberscrub and learn
how to protect your valuable information
when you sell your computer or take it in
for repair.

To prevent Xupiter from being installed without your permission, make sure that your Internet Security Settings are set properly.

To prevent Gator from being installed without your permission, make sure that your Internet Security Settings are set properly. Go to Tools/Internet Options/Security and click on Custom Level. Under ActiveX controls and plug-ins, set the options as follows:

Of course, if you have already been Xupiterized, this will only prevent subsequent infections once you get it off your computer.

You can remove Xupiter manually if you like hacking around in the Windows Registry, but there are much easier and automated ways to get rid of this pest.

Check out our What's New Page every time you visit the PC Fear Factor web site.

There are a number of free adware / spyware detection and removal tools available on the web that can automatically remove Xupiter from your computer.

I use Lavasoft's Ad-aware, a free adware/spyware detection/removal utility. (The free version detects and removes spyware. There is another version, Ad-aware Plus, that claims to help prevent spyware from being installed on your machine. I have not tested Ad-aware Plus as of this time.)

To remove Xupiter from your computer, download and install Ad-aware. The current version is version 6.0, which was released on January 27, 2003. If you have an older version of Ad-aware installed it may not be able to detect Xupiter, so I suggest that you immediately download and install the latest version.

Once you have downloaded and installed Ad-aware, open the application and click on "check for updates now".

This will download and install the latest reference file. The reference file is analogous to the virus definitions file in antivirus software - it is what allows Ad-aware to identify spyware that has been installed on your machine. I suggest that you check for updates frequently to be certain you are protected against the latest spyware threats. Ad-aware does not currently automatically update your reference file, the way that antivirus software automatically updates your virus definition file when you are connected to the Internet.

Then, run Ad-aware. Ad-aware will scan your computer and detect all of the Xupiter files and entries to be deleted. (Note: The picture below is from version 5.83 of Ad-aware. However, the user interface is similar in 6.0)