print version

Xupiter

For Information and Removal of Xupiter

Xupiter - Out of this World Problems For You

If you've recently noticed slowdowns on your machine, or you've seen a strange new toolbar during your Internet Explorer experience, it's possible you have a new adware visitor on your machine called Xupiter.

What is Xupiter?
Xupiter is adware that appears in the form of a BHO, or browser helper object. Essentially, it's a toolbar that is supposed to enhance your internet viewing experience. Unfortunately, though, it is difficult to remove, and it employs a number of incredibly unfriendly tactics that include spying on your every move and reporting it to a third party so  you can be sent the correct ads for your viewing experience and changing your internet security settings as well as your default home page.

What Might I Notice with Xupiter?

If you have Xupiter installed on your machine, you may notice a number of things. One of the most obvious signs you'll see is that a new toolbar will open anytime you log into Internet Explorer. You may also notice that your home page settings have been changed. Even if you try to change them back, you'll just be redirected to its search engine page again when you reopen Internet Explorer. It also makes changes to your IE settings, allowing its adware buddies to get through your system easily. You may also see other IE settings changed. For example, the file not found page you typically see will become the Xupiter search engine page. It will add program files and registry keys on your system. It will also send your personal data back to the home server so ads can be directly targeted to your browsing experience. Moreover, during any given browsing experience, you'll get lots of popup ads related to what you're viewing. For example, if you're looking for home security products, you may get popups for products like camera pens and so on. Sometimes the ads aren't related, but during any given session, you may notice hundreds of popups and popunders, thus seriously slowing your system.

Where Did Xupiter Come From?

It's difficult to tell exactly where Xupiter comes from, but the best guess of many internet experts is that it originated somewhere in Hungary. Daniel Yomtobian, CEO of ABCSearch.com, has been suggested by many to be the creator of Xupiter, and on June 9, 2006, he defended his name against these individuals by having legal action taken, so no official conclusions have been made yet.

How Did I Get Xupiter?

Xupiter works only with Internet Explorer users. It functions through ActiveX. During any given browsing experience, a user might be prompted to install an additional ActiveX control. When you click the popup, Xupiter installs on your machine. This can only happen if your security settings allow it to, but it's hard to know what to do and how to adjust your settings during any given  browsing experience. A good spyware catcher like ParetoLogic should be able to keep you from serious problems, as might using an alternative browser like Mozilla Firefox.

How Can I Remove Xupiter?

Xupiter is one of the most difficult adware removal processes on the planet. Many of the files that come with Xupiter are hidden on your computer, and some of them are capable of further hiding themselves. This means that while you may be able to access it from the add/remove programs panel of your computer, you'll never be able to completely delete the file list in this manner. Instead, removing Xupiter will take one of three steps on your part. Your first option is to try to do a system restore or boot to your last known good settings. Xupiter can affect any version of Windows, though, so this isn't always possible for all users, and in the end, it might not work anyway. Your next option is to use your current anti-spyware to get rid of Xupiter. If, though, you don't have a good anti-spyware product, you may need to download one. ParetoLogic is a good choice, but if you're going to look around a bit before choosing a product, be warned. Lots of adware programs pose as anti-spyware devices, but few of them truly are. In many cases, they are simply other adware programs that will further damage your system. Find a reputable anti-spyware product before downloading. Keep it up to date, and be sure to run a scan on your machine at least once each week. Your final option is to remove Xupiter manually. This is fairly difficult for computer novices, though, and if you've never worked with your system files or your computer's registry, it's a good idea that you  not start now. Working within your registry can damage your machine far worse than Xupiter ever could, so if you insist, at least have a professional by your side the first few times you deal with the registry. A list of files and registry keys that must be removed follows this article.

Xupiter will certainly become a bothersome part of your  machine. Remove it at your earliest opportunity.

Each of these files must be removed: popunder.exe xupiterwauninstaller.exe xupiterstartup2003.exe xupitertoolbar.exe xupitertoolbarinstaller.exe praize.exe xtcfgloader.exe xupiterstartup.exe xupitertoolbaruninstaller.exe xupitertoolbarenstaller.exe rundownload.exe xtcfgrunner.exe browsertoolbarloader.exe browsertoolbarinstaller.exe browserstartup.exe bwcfgloader.exe bwcfgrunner.exe browsertoolbar.exe

Each of these must be removed as well: xtsearch.dll xtupdate.dll xupitertoolbar.dll praizetoolbar.dll popunder.dll xtcfgrunner.dll xtcfgloader.dll browsertoolbar.dll bwsearch.dll bwupdate.dll

Make sure these are gone too: popunder.exe xupiterwauninstaller.exe xupiterstartup2003.exe xupitertoolbar.exe xupitertoolbarinstaller.exe praize.exe xtcfgloader.exe xupiterstartup.exe xupitertoolbaruninstaller.exe xupitertoolbarenstaller.exe rundownload.exe xtcfgrunner.exe browsertoolbarloader.exe browsertoolbarinstaller.exe browserstartup.exe bwcfgloader.exe bwcfgrunner.exe browsertoolbar.exe xtsearch.dll xtupdate.dll xupitertoolbar.dll praizetoolbar.dll popunder.dll xtcfgrunner.dll xtcfgloader.dll browsertoolbar.dll bwsearch.dll bwupdate.dll xupitertoolbaruninstaller.cab

Remove each of the following registry keys:

HKEY_CURRENT_USERSoftwareSQ
HKEY_CLASSES_ROOTCLSID{2662BDD7-05D6-408F-B241-FF98FACE6054}
HKEY_CLASSES_ROOTCLSID{57E69D5A-6539-4d7d-9637-775DE8A385B4}
HKEY_CLASSES_ROOTCLSID{6E6DD93E-1FC3-4F43-8AFB-1B7B90C9D3EB}
HKEY_CLASSES_ROOTCLSID{3C5BA506-6C30-4738-9CED-797ACADEA8DC}
HKEY_CLASSES_ROOTInterface{1A8B567B-BD3F-44A1-8B94-F50D37A1914E}
HKEY_CLASSES_ROOTInterface{B8CFDC9E-E634-40E3-A51E-C097F23D53B9}
HKEY_CLASSES_ROOTInterface{D686DB39-659A-491A-A35C-60B99495C16E}
HKEY_CLASSES_ROOTInterface{3A021D2F-5F75-47F5-9BAB-A137E1FB015F}
HKEY_CLASSES_ROOTInterface{32E715F3-6481-4118-A689-504312933CE6}
HKEY_CLASSES_ROOTTypeLib{118AF62F-21B1-4492-8111-C1A03C5E09CB}
HKEY_CLASSES_ROOTTypeLib{4D0AC936-BDE8-4EA2-B4FB-9F89E5B4C186}
HKEY_CLASSES_ROOTTypeLib{805AF2C8-98C7-4F3C-A7C9-25EBF27567F3}
HKEY_CLASSES_ROOTTypeLib{909E0059-F545-42DE-9D2C-CC4A3E336EC3}
HKEY_CLASSES_ROOTTypeLib{C6C2871F-7467-4A35-90FA-9E9894BC1916}
HKEY_CLASSES_ROOTTypeLib{43732063-1BDA-45A0-BBEE-13E014CB4041}
HKEY_CLASSES_ROOTSQToolbar.Band
HKEY_CLASSES_ROOTSQToolbar.Band.1
HKEY_CLASSES_ROOTXTSearch.XTSearchHook
HKEY_CLASSES_ROOTXTSearch.XTSearchHook.1
HKEY_CLASSES_ROOTXTUpdate.XT
HKEY_CLASSES_ROOTXTUpdate.XT.1
HKEY_CLASSES_ROOTXupiterToolbar.Band
HKEY_CLASSES_ROOTXupiterToolbar.Band.1
HKEY_CLASSES_ROOTXTUpdate.XT
HKEY_CLASSES_ROOTXTUpdate.XT.1
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCode Store DatabaseDistribution Units
{3C5BA506-6C30-4738-9CED-797ACADEA8DC}
HKEY_CLASSES_ROOTClassesSQLoader.Loader
HKEY_CLASSES_ROOTClassesSQLoader.Loader.1
HKEY_CURRENT_USERSoftwareXupiter
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallSqwire
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{2662BDD7-05D6-408F-B241-FF98FACE6054}

You should also find the subkey:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun

and delete these values from it:
"SQInstaller" = "SQInstaller.exe"
"SQConfigChecker" = "cc.exe"
"XupiterStartup" = "%ProgramFiles%XupiterXupiterStartup.exe"
"XupiterCfgLoader" = "%ProgramFiles%XupiterXTCfgLoader.exe"
"SQUpdatesChecker" = "%ProgramFiles%Sqwireuc.exe"
"SQConfigChecker" = "%ProgramFiles%Sqwirecc.exe"
"XupiterToolbarLoader" = "%ProgramFiles%XupiterXupiterToolbarLoader.exe"

Find this subkey:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar

and get rid of:
"{57E69D5A-6539-4d7d-9637-775DE8A385B4}" = "ToolBand Class"

Find:
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks

and delete:
"{6E6DD93E-1FC3-4F43-8AFB-1B7B90C9D3EB}" = ""

Removing Xupiter Automatically/Safely

For free automatic removal we recommend using Malwarebytes Anti-Malware. This program is widely recommended by reputable third-party sites, so you can be reasonably confident of its ability to safely get rid of Xupiter and any hidden Trojans. As a precaution we recommend double checking your system with Spyware Doctor. This program requires paid registration to enable deletions, however it has a money back guaranteed and is the top of the line in malware removal. It should catch malware that evades Malwarebytes and block anything that tries to reinstal itself.

Remove Xupiter Now:

1. Download and install Malwarebytes Anti-Malware and Spyware Doctor  
2. Run Reimage PC Repair Online to check for malware damage and repair if required.
3. Run a scan with Malwarebytes Anti-Malware.
4. Remove all the detected infections (free).
5. Run a scan with Spyware Doctor
6. Remove any remaining infections
7. Reboot and rescan with Spyware Doctor. Your computer should now be clean.

Important note: If Malwarebytes is blocked by malware then run Chameleon (Start Menu → All Programs → MalwareBytes' Anti-Malware → Tools → Malwarebytes' Anti-Malware Chameleon). If you need further help removing Xupiter please email us at info@removeadware.com.au or call for personal assistance on toll-free number 888-655-3453, within the USA and Canada.

 to top