View Single Post
  #1 (permalink)  
Old March 19th, 2002
Unregistered
Guest
 
Posts: n/a
Arrow New Morpheus Contains Spyware

Short story: I have found that Morpheus Preview Edition (the new version
of Morpheus) contains spyware which launches everytime Internet Explorer
is invoked.

Long story: I noticed that Internet Explorer was being very slow to
launch as of a few days ago. I also noticed that my computer's webserver
logs contained an odd line, which seemed to coincide with my Internet
Explorer launches:

05:05:40 127.0.0.1 HEAD /bpboh.dll - 404 162 150 0 HTTP/1.1
rdxrDLL;SID=b0000001;DllVers=1.0.0.0

I decided to a bit of digging. I first confirmed that this hit to my
local webserver does occur each time Internet Explorer is launched. Then, I launched File Monitor (free tool from www.sysinternals.com) to see
what files IE was launching at startup. Turns out it was running this
bpboh.dll file:

12:07:48 AM IEXPLORE.EXE:1208 IRP_MJ_CREATE
D:\WINDOWS\bpboh.dll SUCCESS Attributes: N Options: Open

Interesting. So I decided to rename the file to hide it. Launching
Internet Explorer again did not cause my webserver to log the "bpboh.dll"
hit.

Next I examined the bpboh.dll file, and found all sorts of curious
references in it: one to "BuyersPort" (the 'Shop' page on the new
Morpheus), a few to Barnes and Noble, Sephora, and two very curious ones:

www.rdxrp.com - visiting this site takes you to Morpheus' Homepage

"morph" - possible a reference to Morpheus?

I then went to the Morpheus directory, and saw that the installer log left this behind

RegDB Key: SOFTWARE\rdxr
RegDB Val: 1.3.3.1
RegDB Name: mv
RegDB Root: 2
RegDB Old: 1.3.3.1
Self-Register: D:\WINDOWS\bpboh.dll
User Rights: Admin

Clearly, this means that Morpheus is installing Spyware.

Please announce this on your website, and also tell people that they can delete the spyware simply by deleting the bpboh.dll. It may also be a good idea to search through the registry for references to bpboh.dll and delete them; though only experienced users should do that.
Reply With Quote