Xupiter

» see xupiter.com as it lived, on the wayback machine

~ the last words ~

Around 2003, every shared Windows machine I sat down at had a toolbar on it that nobody had chosen. Often two of them, stacked, eating the top third of an Internet Explorer window that was already too small. Xupiter was one of the names attached to that experience, and by most accounts it was the worst behaved of the lot.

It was not a program in any sense a user would recognize. It was an Internet Explorer toolbar that seized the home page along with whatever the address bar did when you typed something into it that was not a URL. Both got pointed at properties the company owned. A word typed into the wrong box no longer went to Google, it went to browserwise.com or sqwire.com, depending on which build had landed on the machine.

The install path is the part that still reads badly. Xupiter came in through Internet Explorer's automatic ActiveX installation, from affiliate pages and pop-up ads. Default IE security settings in that era were loose enough that on a lot of machines the consent dialog either never appeared or appeared worded as though refusing it would break the page. It was also bundled into Grokster, so a share of the infections came from people who had installed something on purpose and got this too.

~ the record ~

~ what made it different ~

Adware was already a normal part of the Windows experience by 2002. Xupiter stood out because of what it did after installing. There was no uninstall entry. The directory it sat in resisted deletion while the machine was running, because the running process put it back.

The genuinely alarming part was the update channel. The toolbar contacted its own servers to ask for code and executed whatever it received without checking anything. Whoever controlled that server controlled every machine running the toolbar, and nobody outside the company knew who that was.

~ how people got rid of it ~

Ad-aware had Xupiter in its detection lists by September 2002, and Spybot Search and Destroy followed. For a while the standard advice on forums was a manual procedure involving safe mode and a registry editor, written out step by step by people who had already lost an afternoon to it. That advice was reposted on message boards in most languages on the web, which is a decent proxy for how far the thing traveled.

By late 2003 the answer columns had switched tense. The service had shut down. The toolbar was still out there on unpatched machines, still redirecting searches, but the domains at the other end had stopped paying rent.

~ the long tail ~

Xupiter is remembered mostly as the thing that made the rest of the industry take browser security seriously. Microsoft tightened ActiveX defaults, then tightened them again in XP Service Pack 2, and the drive-by install through a trust prompt stopped being a viable distribution channel. The toolbar business moved to bundled installers with a pre-checked box, which was worse in volume but at least involved a click.

The lasting inheritance is smaller and more annoying: an entire generation of users who learned to decline every dialog box on sight, including the ones that mattered.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »