dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
8684
share rss forum feed


Doctor Four
My other vehicle is a TARDIS
Premium
join:2000-09-05
Dallas, TX

Article says Morpheus PE is spyware

I found a link to an article in the Becky User's
forums that accuses Morpheus Preview Edition of
being spyware. The article is titled Morpheus: A
New Low, and can be found here
--
"Kayura or Badamon, whichever you are, you should know that I will never give up this battle. By the will of the Ancient, I shall succeed!" - Shuten (Anubis) from the Ronin Warriors.


WildGod
God Is Dead
Premium
join:2002-01-30
NYC

good find
anyone find this dll
i had morpheus pe uninstalled it but i didnt have this file
[text was edited by author 2002-03-19 00:16:08]


maximus_808
Proud Veteran
Premium
join:2001-08-27
Troutdale, OR
reply to Doctor Four
I found it but it will not let me delete it.
--
What we do in life..echoes in eternity.


maximus_808
Proud Veteran
Premium
join:2001-08-27
Troutdale, OR
reply to Doctor Four
This may be better served in the security forum. I predict this will not end pretty.
--
What we do in life..echoes in eternity.


emead
4q2
Premium,MVM
join:2000-09-04
Danbury, CT

reply to Doctor Four
I had already uninstalled MorpheusPE, but ran a reg. scan and a find files and no bpboh.dll was found. Probably gets uninstalled with Morpheus, even if this says different,

and it does not come off after one uninstalls Morpheus either. If you don’t delete this .dll or reformat your computer. You most likely will never get rid of this.
--
I gave up searching for the Truth, Now I'm looking for a good Fantasy!

[text was edited by author 2002-03-19 06:51:31]


maximus_808
Proud Veteran
Premium
join:2001-08-27
Troutdale, OR
reply to Doctor Four
I dont think so....i un installed morpheus yesterday and its there. the artical said somthing about it being an XP and IE6 problem.
--
What we do in life..echoes in eternity.


emead
4q2
Premium,MVM
join:2000-09-04
Danbury, CT

Probably so, as I still use Win98 and IE 5.5
[text was edited by author 2002-03-19 06:54:07]


Anav
Sarcastic Llama? Naw, Just Acerbic
Premium
join:2001-07-16
Dartmouth, NS
kudos:5
What does this file supposedly do??
[ Cannot access article from our LAN :-( ]


emead
4q2
Premium,MVM
join:2000-09-04
Danbury, CT
Morpheus was once a great file sharing program evasively dodging the lawsuit bullets of many industry giants. Millions upon millions of users logged in to its P2P network daily swapping files and sharing songs. Driven by ads Morpheus started out a spyware extravaganza, as later releases removed these invasive ads Morpheus gained the confidence of millions of users who were initially vexed about using the software.

Just a few weeks ago Morpheus released their newest edition dubbed “preview addition 1". However, it seems this latest version has reverted back to using “spyware” as a new invasive, unseen, little beast silently takes hold of one’s IE browser. What is now happening is that when one types the name of most common shopping websites, such as buy.com or amazon.com, your browser recognizes this call and rather than moving directly to that page it calls a separate URL first. Examples are as follows when I type in the bold URL it goes to the non bolded URL first:

buy.com
»ad.linksynergy.com/fs-bin/show?i ··· &subid=0

ebay.com
»www.qksrv.net/image-280514-22026 ··· -2202641

amazon.com
»www.amazon.com/exec/obidos/redir ··· rsport04

staples.com
»service.bfast.com/bfast/serve?bf ··· =home012

officemax.com
»ad.linksynergy.com/fs-bin/show?i ··· &subid=0

dell.com
»ad.linksynergy.com/fs-bin/show?i ··· &subid=0

and the list goes on and on and on...

These separate URLS are for referral programs which takes a commission from purchases you make at the store following this URL. While this is fine if you click off of a link from another website, what is NOT ok is for spyware to insert a small line of code onto your computer (in this case a .dll file but more on that later) to cause these referral links to automatically show. What’s more is that it is doing all this without asking you first. This is invasion of privacy, and we must take a stand to put it at an end.

How do I know Morpheus Preview1 is doing this?

Well this is a rather simple item. First off I had to track down exactly what was causing the redirects. This was most certainly not an easy task. After searching a number of message boards, most notably the ones from the German anti-spyware site lavasoft.de's forums as well as [H]ardOCP's I was able to track it down to a simple .dll file. This file as the board points out is called bpboh.dll and is placed in one’s C:/windows and interacts with Internet Explorer 6.0 (I did not test any earlier versions of IE, and all versions of Netscape are unaffected) in such a way as to cause redirects first to referral sites than to the appropriate website.

Now, once I tracked down the file causing the redirects I was able to simply delete it and all references to it in the registry. Upon deleting it I noticed that the redirects were gone! Now, to test out my theory that this elusive spyware was packaged with Morpheus P1 I simply reinstalled it to see if it would resurface, and of course it did.

The bpboh.dll file’s description does not tell us much about who thought up this nasty little scheme, which I do admire for its genius, other than it has been manifested by Wurld Media Inc. What this has to do with Morpheus I’m not sure, but what I am sure of is that it came with the program, or at least in prv1.

How do I rid of it?

For those of you who don’t want to read my logic behind this whole mess and want to simply rid themselves of this nasty computer spyware disease follow these simple steps:

1) First run a search on your C: drive for the file bpboh.dll after the search has completed it should return one result.
2) Delete the file
3) Next it’s a good idea (but not necessary) to run a search through the registry for all references to Morpheus and bpboh.dll.

That’s it!

Now while it’s not really as bad as some of the spyware that some people have been encountering lately it’s more the principal of the matter and that there is NO way to get rid of it without deleting the .dll file. Reinstallations of IE proved no effect, and it does not come off after one uninstalls Morpheus either. If you don’t delete this .dll or reformat your computer. You most likely will never get rid of this. It’s sad to think of the millions of people who probably won’t even notice the referral link and sheepishly generate millions for whomever is behind this little scheme.

Please note that this may only be affecting IE6 under WinXP, though that is not yet confirmed, please e-mail me if you are having this problem under any other platform.

by Ryan Wissman
3/18/2002
--
I gave up searching for the Truth, Now I'm looking for a good Fantasy!


Lex Luthor
Premium,Mod
join:2000-09-17
Hicksville, NY
kudos:3

reply to Doctor Four
Would love to see some independent verification of this.

If it's true, Morpheus is going to get lots of bad pub over this. Technically it's not really "spyware" since it's not sending anything out of your pc to them. Even still, it's very low.

If I had installed this, I never would have figured out what's wrong. I have all those referral links blocked in my hosts file. I would have spent a long time wondering why I couldn't get to those sites, probably.
[text was edited by author 2002-03-19 07:18:02]


storm64007
Premium
join:2001-05-21
Freeport, NY
reply to WildGod
I hated the preveiw edition and uninstalled it and dont find this dll at all. I also tried the websites the article mentioned and not getting the responce the article states. Most probably it uninstalls when you delete the program.


banditws6
Shrinking Time and Distance
Premium
join:2001-08-18
Frisco, TX
Reviews:
·Time Warner Cable
Thanks for the heads up. I tried Morpheus PE1 for about three minutes before deciding it wasn't worth my time; I'm running XP and IE6 so when I get home I'm gonna look for that DLL.

All Morpheus is now is a Gnutella client; it looks strikingly like Gnucleus to me. No point in it anymore. I find KaZaA Lite (spyware free version) quite a bit more useful.
--
"Two things are infinite: the universe and human stupidity, and I am not sure about the universe." -Albert Einstein


Hall
Premium,MVM
join:2000-04-28
Germantown, OH
kudos:2
reply to emead
said by emead:
...If you don’t delete this .dll or reformat your computer. You most likely will never get rid of this.
I suggest you learn this old thing called "DOS". There's no file you can't delete this way...
--
-= Mindspring MaxDSL via Covad 1536/384 TeleSurfer Pro =-


WildGod
God Is Dead
Premium
join:2002-01-30
NYC
or try deleting it in safe mode perhaps?
--
AOL DSL SUCKS


antiserious
The Future ain't what it used to be
Premium
join:2001-12-12
Scranton, PA
Reviews:
·Comcast
reply to Doctor Four

Re: ... now I'm confused ...

... first off, I'm running W98SE, IE6 and proxo ... I have the Morph PE still installed on this 'puter, along with the Old morph 1.3.3, which is still workin' .. haven't used PE in 12-14 days, cuz it's such a resource hog ... when I click on the link in the original post, proxo wipes out the whole article - have to bypass to read it ... I can find no sign of 'bpboh.dll', with AdAware, or the 'find' feature, or by searching C:/WINDOWS manually ... when I type in the URL's mentioned in the article I seem to go right to those sites, with no redirect ... so I'm wondering if Morpheus would bother planting spyware that would ONLY affect WinXP users ... I mean, that's not the dominant OS out there yet, is it ? ... and isn't it supposed to be the most secure OS Microsoft ever developed ?? ...

... I'd be REAL interested in where this leads, since I've always supported Morpheus because of their 'No Spyware' stance ... is anyone aware of any comment they've made on this issue ? ...
--
"Suicidal Twin Kills Brother By Mistake ... film at 11"


Anav
Sarcastic Llama? Naw, Just Acerbic
Premium
join:2001-07-16
Dartmouth, NS
kudos:5
reply to banditws6

Re: Article says Morpheus PE is spyware

kazaa lite.. spyware free URL plse!!


WildGod
God Is Dead
Premium
join:2002-01-30
NYC
»Here's how to disable the Kazaa spyware

that forum discusses how to neuter kazaa
--
AOL DSL SUCKS

mosingleton5

join:2001-12-02
Lutz, FL
reply to emead
I am running XP and I had the .dll even after I uninstalled Morpheus Preview so I ran the registry as indicated and found several entries pointing to that dll and Morpheus. Thanks for the heads up and I will pass this on to other Morphers!!

CrazyAndy$

join:2002-03-09
reply to Anav
said by Anav:
kazaa lite.. spyware free URL plse!!
I haven't tried Kazaa Lite, the adbanner and spyware free version, but for all who are interested in Kazaa Lite,
it can be downloaded here : »www.refosearch.tk


WildGod
God Is Dead
Premium
join:2002-01-30
NYC

DO NOT GOT TO THE ABOVE LISTED KAZAA LITE SITE.

IT HAS A VICIOUS CYCLE OF POPUPS AND SCRIPTS!!!!

go to the link i posted above and neutur kazaa yourself.
--
AOL DSL SUCKS

[text was edited by author 2002-03-19 11:43:20]


maximus_808
Proud Veteran
Premium
join:2001-08-27
Troutdale, OR
reply to Doctor Four
I assure you it is still on my system after uninstalling Morpheus. It also does exactly what the story said it does..its very fast especialy with a fast connection but if you watch real close you can see the redirect flash at the bottom of the screen.
--
What we do in life..echoes in eternity.

CrazyAndy$

join:2002-03-09
reply to WildGod
said by wildxgod:
DO NOT GOT TO THE ABOVE LISTED KAZAA LITE SITE.
IT HAS A VICIOUS CYCLE OF POPUPS AND SCRIPTS!!!!

Very surferfriendly site for me, with Scripting disabled in my IE settings. Sorry, if this site really is a pop-up hell. Or is something wrong with the Kazaa Lite program, too ?


WildGod
God Is Dead
Premium
join:2002-01-30
NYC
That site has been discussed in other forums and its very suspicious. You can easily make Kazaa into your own Kazaa Lite. I, along with many ppl on dslreports, do not trust that site. Its better to just d/l kazaa and remove the spyware yourself and add the fake .dll. Its a popup and script hell and if they are doing that, god knows what else they are doing.
--
AOL DSL SUCKS


maximus_808
Proud Veteran
Premium
join:2001-08-27
Troutdale, OR
reply to Doctor Four
I used Norton Wipe info to get rid of the dll. you can see a difference when you go to the sites mentioned. I havent decided if i want to install MPE again to see if it comes back , if it does i dont think i will use Morpheus again and that is a shame.
--
What we do in life..echoes in eternity.

CrazyAndy$

join:2002-03-09
reply to Doctor Four
Okey, then....sorry for posting this link. It has been posted with the best intentions.
Just curious, is it only their website "design" or is it the program itself that makes Kazaa Lite suspicious?


maximus_808
Proud Veteran
Premium
join:2001-08-27
Troutdale, OR
reply to Doctor Four
It would appear that Ad Aware has released an update to cover this problem. I highly recomend everyone get the update and run ad aware. It found a bunch of stuff that wasnt there before.
--
What we do in life..echoes in eternity.


Doctor Four
My other vehicle is a TARDIS
Premium
join:2000-09-05
Dallas, TX
reply to Doctor Four
If any of the above ad redirects are in your Hosts file
(almost certainly all of them if you use Stephen Martin's
Hosts listing or Spyblocker), they won't work. What you'll
likely see is a blank page if one of the redirects is
called by the dll file mentioned.
--
"Kayura or Badamon, whichever you are, you should know that I will never give up this battle. By the will of the Ancient, I shall succeed!" - Shuten (Anubis) from the Ronin Warriors.


WildGod
God Is Dead
Premium
join:2002-01-30
NYC
reply to CrazyAndy$
Its just my opinion but if they bombard you the way they do with all those popups and scripts (some ppl have had to shut down their pc's it got so bad) then how can you trust them? I trust the ppl on Dslreports and my own experience with that site.
I didnt mean to imply you posted it knowing it was a nasty site. Some ppl actually havent had a problem with it since they disabled scripts and have a popup stopper. Still though, I would neuter kazaa myself if i had a choice.
--
AOL DSL SUCKS

CrazyAndy$

join:2002-03-09
reply to Doctor Four
Maybe the scripts and pop-ups have changed as they have moved their site to a new webhost today?
Quote from their site:
"The site has moved to our new host. Special thanks to www.lunarpages.com"

BTW, I'm just reading through the instructions in the link you've posted, how to neuter Kazaa by myself.


Lex Luthor
Premium,Mod
join:2000-09-17
Hicksville, NY
kudos:3
reply to Doctor Four
If anyone is interested, here's a deja thread on this here.