| reply to NHD tech
Re: Anyone know what spywiper is? Hi:
Finally found someone who's been having problems with SpyWiper and who's posted a HJT log. See here:
Browser Controlled, Spy Wiper
»forums.net-integration.net/index···pic=7886
The poster's description matches the symptoms we've heard from other sources:
quote:
It seems I have acquired a problem created by a company called Spy Wiper. When I attempt to go to my home page, the page is re-ddirected to a different URL, and there are 2 or 3 different windows that open. One window is a porn window, one is a note pad advertising spy wiper and causes my CD drawer to open and the other window is advertising links.
I have ran both Ad-ware 6.0 and Spybot-S&D and neither have found anything to correct. I have downloaded HijackThis and am attaching the save log. Could someone please review it and help me clear this up. I am running Windows 98. Please advise if you need any further information.
The HJT log shows, among other things, the following:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://server224.smartbotpro.net/7search/?001
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://server224.smartbotpro.net/7search/?002
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://default-homepage-network.com/start.cgi
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://server224.smartbotpro.net/7search/?003
The smartbotpro.net links take you to various pages that are related to 7Search Networks (7search.com) and that attempt to do something with JavaScript -- not sure what as the pages don't seem to work properly in Mozilla 1.5 (haven't tried with IE wide and open).
The default-homepage-network.com link takes you to this page:
hxxp://default-homepage-network.com/index2.html
...which is a SpyWiper ad (pointing to mailwiper.com). It also pops open this notice:
hxxp://default-homepage-network.com/spypop4.html
...and eventually to this notice:
hxxp://default-homepage-network.com/spytxt.txt
So far, this appears to be a case of obnoxious, high-pressure advertising. No evidence so far that SpyWiper itself is foisting something onto users' computers.
Best,
Eric L. Howes |
