What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Spynuker & Gi2wy5sw0y0 Popups

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Can't get rid of Spynuker & gi2wy5sw0y0.com browser popups.
Thanks in advance. :wavey:

Logfile of HijackThis v1.97.7
Scan saved at 1:49:34 PM, on 2/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\Hummingbird\Connectivity\7.10\Inetd\inetd32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\MsgSys.EXE
C:\WINNT\System32\hkcmd.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
c:\progra~1\hummin~1\connec~1\7.10\exceed\exceed.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\System32\cmd.exe
C:\WINNT\System32\cmd.exe
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
C:\WINNT\System32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\msagent\AgentSvr.exe
C:\Program Files\Adobe\Acrobat 5.0\Acrobat\Acrobat.exe
C:\Program Files\Common Files\Adobe\Web\AOM.exe
C:\DOCUME~1\Keyoun\LOCALS~1\Temp\setup_ssn.exe
C:\Program Files\SAS Institute\Shared Files\JRE\1.4.1\bin\java.exe
\sassd.unx.sas.com\sassd_root\sps912-sps-20040121\config1cd\cfgwizard\Disk1\InstData\Windows\setup.exe
C:\DOCUME~1\Keyoun\LOCALS~1\Temp\I1075931071\Windows\setup.exe
C:\Program Files\SAS\SAS 9.1\sas.exe
C:\Program Files\Microsoft Office\Office10\POWERPNT.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
\sashq\root\dept\iss\Phone\Phone.exe
C:\Documents and Settings\Keyoun\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://sww.sas.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SAS
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://sww.sas.com/pac/sww.pac
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1008CC36-DC63-43F8-B61E-3B187A925CAF} - C:\WINNT\System32\skbdmac.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\winnt\googletoolbar_en_2.0.95-big.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\winnt\googletoolbar_en_2.0.95-big.dll
O3 - Toolbar: (no name) - {91A034B1-580F-4D62-9890-E24897AEE681} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\ORL\VNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [SS_Script] wscript C:\WINNT\system32\ss_script.vbs
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O4 - Startup: SAS Phone Dialer.lnk = dept\iss\Phone\Phone.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Zwrite.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\winnt\GoogleToolbar_en_2.0.95-big.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\winnt\GoogleToolbar_en_2.0.95-big.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\winnt\GoogleToolbar_en_2.0.95-big.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://c:\winnt\GoogleToolbar_en_2.0.95-big.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page - res://c:\winnt\GoogleToolbar_en_2.0.95-big.dll/cmtrans.html
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://sww.sas.com
O15 - Trusted Zone: *.peopleclick.com
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {8DDFB1F0-AC20-11D4-87DB-00C04F2C3577} (ClipSaveCtrl Class) - http://sww.sas.com/ds/dll/ClipSave.dll
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…37782.253287037
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - http://activex.microsoft.com/activex/contr…ate/sdkinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = na.sas.com
O17 - HKLM\Software\..\Telephony: DomainName = na.sas.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = na.sas.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = na.sas.com,pc.sas.com,fyi.sas.com,unx.sas.com,sas.com,vm.sas.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = na.sas.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = na.sas.com,pc.sas.com,fyi.sas.com,unx.sas.com,sas.com,vm.sas.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = na.sas.com,pc.sas.com,fyi.sas.com,unx.sas.com,sas.com,vm.sas.com
Post #2
Have Hijack This fix all of the following by placing a check in the appropriate boxes and hitting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank

O2 - BHO: (no name) - {1008CC36-DC63-43F8-B61E-3B187A925CAF} - C:\WINNT\System32\skbdmac.dll

O3 - Toolbar: (no name) - {91A034B1-580F-4D62-9890-E24897AEE681} - (no file)

O15 - Trusted Zone: *.peopleclick.com



Reboot, after fixing.

The O15 is an optional fix. Personally I allow nothing in the trusted zone, but if you are happy with the site listed, then leave it.

Do you know what this entry refers to:

O4 - HKLM\..\Run: [SS_Script] wscript C:\WINNT\system32\ss_script.vbs

If unknown, please find the file C:\WINNT\system32\ss_script.vbs, and check the properties. If still uncertain, open it in Notepad, and post the contents here. It will be possible to tell if it is malicious, and needs fixing with Hijack this.
Post #3
Dave, Thanks for your help – I followed your suggestions and that fixed the problem! No more spywarenuker popups! That ss_scirpt.vbs turned out to be something my employer runs on my machine. Those popups had been bothering me for weeks, too. B) I love you! Ann-Marie
Post #4
Glad we could help :D

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI