Broadband Tech > Security > Security > Article says Morpheus PE is spyware

Article says Morpheus PE is spyware

good find
anyone find this dll
i had morpheus pe uninstalled it but i didnt have this file
[text was edited by author 2002-03-19 00:16:08]

reply to Doctor Four
I found it but it will not let me delete it.
--
What we do in life..echoes in eternity.

reply to Doctor Four
This may be better served in the security forum. I predict this will not end pretty.
--
What we do in life..echoes in eternity.

reply to Doctor Four
I had already uninstalled MorpheusPE, but ran a reg. scan and a find files and no bpboh.dll was found. Probably gets uninstalled with Morpheus, even if this says different,

and it does not come off after one uninstalls Morpheus either. If you don’t delete this .dll or reformat your computer. You most likely will never get rid of this.
--
I gave up searching for the Truth, Now I'm looking for a good Fantasy!
[text was edited by author 2002-03-19 06:51:31]

reply to Doctor Four
I dont think so....i un installed morpheus yesterday and its there. the artical said somthing about it being an XP and IE6 problem.
--
What we do in life..echoes in eternity.

Probably so, as I still use Win98 and IE 5.5
[text was edited by author 2002-03-19 06:54:07]

What does this file supposedly do??
[ Cannot access article from our LAN :-( ]

Morpheus was once a great file sharing program evasively dodging the lawsuit bullets of many industry giants. Millions upon millions of users logged in to its P2P network daily swapping files and sharing songs. Driven by ads Morpheus started out a spyware extravaganza, as later releases removed these invasive ads Morpheus gained the confidence of millions of users who were initially vexed about using the software.

Just a few weeks ago Morpheus released their newest edition dubbed “preview addition 1". However, it seems this latest version has reverted back to using “spyware” as a new invasive, unseen, little beast silently takes hold of one’s IE browser. What is now happening is that when one types the name of most common shopping websites, such as buy.com or amazon.com, your browser recognizes this call and rather than moving directly to that page it calls a separate URL first. Examples are as follows when I type in the bold URL it goes to the non bolded URL first:

buy.com
»ad.linksynergy.com/fs-bin/show?i···&subid=0

ebay.com
»www.qksrv.net/image-280514-2202641

amazon.com
»www.amazon.com/exec/obidos/redir···rsport04

staples.com
»service.bfast.com/bfast/serve?bf···=home012

officemax.com
»ad.linksynergy.com/fs-bin/show?i···&subid=0

dell.com
»ad.linksynergy.com/fs-bin/show?i···&subid=0

and the list goes on and on and on...

These separate URLS are for referral programs which takes a commission from purchases you make at the store following this URL. While this is fine if you click off of a link from another website, what is NOT ok is for spyware to insert a small line of code onto your computer (in this case a .dll file but more on that later) to cause these referral links to automatically show. What’s more is that it is doing all this without asking you first. This is invasion of privacy, and we must take a stand to put it at an end.

How do I know Morpheus Preview1 is doing this?

Well this is a rather simple item. First off I had to track down exactly what was causing the redirects. This was most certainly not an easy task. After searching a number of message boards, most notably the ones from the German anti-spyware site lavasoft.de's forums as well as [H]ardOCP's I was able to track it down to a simple .dll file. This file as the board points out is called bpboh.dll and is placed in one’s C:/windows and interacts with Internet Explorer 6.0 (I did not test any earlier versions of IE, and all versions of Netscape are unaffected) in such a way as to cause redirects first to referral sites than to the appropriate website.

Now, once I tracked down the file causing the redirects I was able to simply delete it and all references to it in the registry. Upon deleting it I noticed that the redirects were gone! Now, to test out my theory that this elusive spyware was packaged with Morpheus P1 I simply reinstalled it to see if it would resurface, and of course it did.

The bpboh.dll file’s description does not tell us much about who thought up this nasty little scheme, which I do admire for its genius, other than it has been manifested by Wurld Media Inc. What this has to do with Morpheus I’m not sure, but what I am sure of is that it came with the program, or at least in prv1.

How do I rid of it?

For those of you who don’t want to read my logic behind this whole mess and want to simply rid themselves of this nasty computer spyware disease follow these simple steps:

1) First run a search on your C: drive for the file bpboh.dll after the search has completed it should return one result.
2) Delete the file
3) Next it’s a good idea (but not necessary) to run a search through the registry for all references to Morpheus and bpboh.dll.

That’s it!

Now while it’s not really as bad as some of the spyware that some people have been encountering lately it’s more the principal of the matter and that there is NO way to get rid of it without deleting the .dll file. Reinstallations of IE proved no effect, and it does not come off after one uninstalls Morpheus either. If you don’t delete this .dll or reformat your computer. You most likely will never get rid of this. It’s sad to think of the millions of people who probably won’t even notice the referral link and sheepishly generate millions for whomever is behind this little scheme.

Please note that this may only be affecting IE6 under WinXP, though that is not yet confirmed, please e-mail me if you are having this problem under any other platform.

by Ryan Wissman
3/18/2002
--
I gave up searching for the Truth, Now I'm looking for a good Fantasy!

reply to Doctor Four
Would love to see some independent verification of this.

If it's true, Morpheus is going to get lots of bad pub over this. Technically it's not really "spyware" since it's not sending anything out of your pc to them. Even still, it's very low.

If I had installed this, I never would have figured out what's wrong. I have all those referral links blocked in my hosts file. I would have spent a long time wondering why I couldn't get to those sites, probably.
[text was edited by author 2002-03-19 07:18:02]

reply to WildGod
I hated the preveiw edition and uninstalled it and dont find this dll at all. I also tried the websites the article mentioned and not getting the responce the article states. Most probably it uninstalls when you delete the program.

Thanks for the heads up. I tried Morpheus PE1 for about three minutes before deciding it wasn't worth my time; I'm running XP and IE6 so when I get home I'm gonna look for that DLL.

All Morpheus is now is a Gnutella client; it looks strikingly like Gnucleus to me. No point in it anymore. I find KaZaA Lite (spyware free version) quite a bit more useful.
--
"Two things are infinite: the universe and human stupidity, and I am not sure about the universe." -Albert Einstein

reply to emead

said by emead:

---

...If you don’t delete this .dll or reformat your computer. You most likely will never get rid of this.

---

or try deleting it in safe mode perhaps?
--
AOL DSL SUCKS

reply to Doctor Four

Re: ... now I'm confused ...

reply to banditws6

Re: Article says Morpheus PE is spyware

»Here's how to disable the Kazaa spyware

that forum discusses how to neuter kazaa
--
AOL DSL SUCKS

reply to emead
I am running XP and I had the .dll even after I uninstalled Morpheus Preview so I ran the registry as indicated and found several entries pointing to that dll and Morpheus. Thanks for the heads up and I will pass this on to other Morphers!!

reply to Anav

said by Anav:

---

kazaa lite.. spyware free URL plse!!

---

DO NOT GOT TO THE ABOVE LISTED KAZAA LITE SITE.

IT HAS A VICIOUS CYCLE OF POPUPS AND SCRIPTS!!!!

go to the link i posted above and neutur kazaa yourself.
--
AOL DSL SUCKS
[text was edited by author 2002-03-19 11:43:20]