Spy-adware question pls

Hi all, have come across 3x malicious spys into my system.winsync.exe & syncroad.exe, (program files/windows syncroAd)
& ide21201.vxd, in (winsys32folder)have run both adaware se 1.05 and spybot, these will locate and remove all , but alas they all re-boot everytime.have tried to manually remove them but xp wont allow this.any help out there gents,
regards
Mark

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

RE: spy-adware question pls, James, Sep-26-04, 00:06 AM, (1) RE: spy-adware question pls, dvdhoven, Sep-26-04, 01:08 AM, (2) RE: spy-adware question pls, derekmorton, Sep-26-04, 05:40 AM, (3) RE: spy-adware question pls, condmike, Sep-26-04, 02:06 PM, (4) RE: spy-adware question pls, Night Train, Oct-02-04, 09:15 PM, (5) RE: spy-adware question pls, SouthwestChief, Oct-02-04, 10:30 PM, (6) RE: spy-adware question pls, dvdhoven, Oct-03-04, 01:36 AM, (7) RE: spy-adware question pls, SP6307, Oct-03-04, 02:03 AM, (8) RE: spy-adware question pls, SouthwestChief, Oct-03-04, 02:25 AM, (9) RE: spy-adware question pls, Vince, Oct-04-04, 03:23 PM, (10) RE: spy-adware question pls, heffed, Oct-04-04, 08:24 PM, (11) RE: spy-adware question pls, rpicardi1, Oct-04-04, 09:45 PM, (12) RE: spy-adware question pls, chosenfrozen44, Oct-05-04, 07:59 PM, (13) RE: spy-adware question pls, rpicardi1, Oct-05-04, 08:32 PM, (14)

Conferences | Topics | Previous Topic | Next Topic

Same probelm had to reboot my xp for this reason. VMRS (Pittsburgh Division) Locomotive Painter

9/11 "A day that we will never forget"

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

LAST EDITED ON Sep-26-04 AT 01:11 AM (EDT)

Hi,You can start WinXP in a kind of DOS mode and try to remove the programs in this mode.For the Recovery Console of XP, see this link:
Win Xp Recovery ConsoleDick van den Hoven

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Hi Mark,Get hold of startup control panel from www.mlin.net, it will show ALL programs that are starting at machine startup.
If you are not sure of anything, post the list here.

Derek
EngMod@sgrail.org
www.sgrail.org
EngMod forum
http://www.3dtrains.com/forums/index.php?s=3c21ea4e4882bb70177f35d82c51523b&act=SF&f=59

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

You should start XP in "SAFE MODE" then you can remove the program.cond mike

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Thanks for replies, finally rid my system of the mentioned
spy-scum-ad wares.I used an old 'win 98' startup disk to boot into DOS,
(thanks dick for tip), deleted the mentioned files, restarted XP, and used startup control (thanks derek) to remove the entries in the registry, and bingo, all fixed.thanks gents,
Mark

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

If anybody knows of a way to get rid of a very nasty little guy called TVMedia let me know. My mom's computer has it and there doesn't seem to be any way to get rid of it! Spybots and the like can't remove it. I've tried what's been posted on line, even gone into the registry to try and manually delete it, but nothing seems to get it. Beware of this guy, and thank God it's not on my computer. But I'd like to know of how to get rid of it, if the day ever comes when it gets on my system
Matt Doti

http://pages.sbcglobal.net/fdoti/index.html

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

LAST EDITED ON Oct-03-04 AT 01:39 AM (EDT)

Hi,I found this links on TVMedia:
http://www.kephyr.com/spywarescanner/library/tvmedia.tvmbho/index.phtml
http://www.spyany.com/program/article_adw_rm_TVMedia.htmlDick van den Hoven

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

99.99999999% of the time you cannot get rid of spyware, is that after deleting the spyware, you need to DELETE ALL the temp folders contents. You should delete the contents of the cache file also. Those are a couple of the places where the reinstall exe's wait for you. After you delete the files, empty the trash to get rid of them.Use Hijackthis, you can get it from the spybot website to assist. It will pinpoint the places in the registry you may have to edit yourself, if it cannot clean it out itself. Make a back up first It will also tell you where the pesky reinstall exe's are hiding.Fred

http://www.anarchist-cookbook.com/
http://www.religioustolerance.org/witchcra.htm

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Well, I tried the method that was linked above before to no avail but I tried it again just to see. And you know what? It worked!!!! It required a bit of trickery on my part in addition to the posted instructions but it seems to be gone now. And best of all my spysweeper will now block it from coming on the computer again now that it knows what it is. So my mom's computer is lightning fast once again. But I warned her not to go to that Broadway music sight again (this is what I suspected of giving her this mini virus in the first place).Thanks for the links. And now if it ever infects my own computer (the one I use for MSTS, and I'd hate for anything to mess with that ) what to do to get rid of it. Beware this one though as a regular Spysweeper isn't enough to kill it.
Matt Doti

http://pages.sbcglobal.net/fdoti/index.html

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

LAST EDITED ON Oct-04-04 AT 03:29 PM (EDT)

I have just done battle with these two yesterday.
I invite the scum who released this to visit me in Las Vegas so I can apply western justice. Oh, and you need not buy a round trip ticket. One way will serve you fine and save you money.It totally hijacked my system. Altered many system .dll files.
Ad-Aware did attempt to remove most of the stuff but there were files/folders/registry entries still left on the system. The spyware really loused up Internet Explorer and in fact, after manually deleting this crap, rendered my system unuseable. Unuseable to the point that I had to do a hot windows install. (ths means I just ran the Windows install without any formating or partitioning)This did clear up the main problem (I was not able to shutdown the system) but there were a few programs I had to re-install also, GMAX for one.I found a readme text file in the SyncroAd folder and get this folks, it basically says, and I'll paraphrase here, "...we installed this on your system because this website pays us to do so. You can remove our stuff but it is very difficult and it may damage your system if you try."
Why in the creators name is malicious crap like this allowed? Man, I really want to smash these people.
Here follows the SyncroAd readme. I would NOT recommend visiting their website addresses at the bottom of the readme.What is Windows SyncroAd?
---------------------
Windows SyncroAd is free ad delivery software which provides targeted advertising offers.
How did Windows SyncroAd get installed on your computer?
----------------------------------------------------
You downloaded Windows SyncroAd from a Website that is able to offer its content for free because
it shows the Windows SyncroAd ActiveX popup. The Wind Update program is installed only once the user
has agreed on it by clicking on “yes”. Through the ActiveX, the user can review the license terms
and privacy policy before installing the software. Each and every distributor is carefully reviewed
to make sure that their distribution techniques abide by a strict code of conduct.If you do not remember having seen an ActiveX prompt, you might have downloaded Windows SyncroAd from a
popular free software product (screensavers, games, file sharing software, etc.). Users always will
have to opt-in before installing the Windows SyncroAd software.
Removal instructions:
---------------------
Windows SyncroAd supports many free software products through its advertising relevancy technology.
If you remove Windows SyncroAd from your system, certain free software that you installed may no longer
function properly and you may have to reinstall them from a backup.If you are sure that you want to remove Windows SyncroAd from your computer just follow these two easy steps:1) Click Start -> Control Panel -> Add/Remove Programs2) Scroll to Windows SyncroAd and click RemoveComment by Vince; This does NOT work. It will reinstall at the next boot. End comment

End User License Agreement:
---------------------------
Please find an up to date copy of Wind Update’s End User License Agreement at
DANGER =======>http://www.windupdates.com/license.html <=====DANGER DO NOT VISIT THIS SITE
========================END OF README TEXT========================Thanks very much SyncroAd, I hope to see you in hell!!!Edit: Run a Google search on syncroad. It is causing major grief on the net.
I would love to see these bastards prosecuted and do hard time. v

Regards,
Vince Cockeram
NEC Track Team
Author: NECv4 Route

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

You could always switch to Firefox. No ActiveX. -Jeff

Union Pacific fan.

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Next time, break the link with spaces so no one can accidently click on it as they can now with unpredictable results.SRV Ron

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

I have this huge pain in the arse called "Searchforit" which totally hijacked my internet browser.....I used to msn....but when I go into internet properties to set my homepage, its all grayed out....cannot get in there to choose. So its locked on searchforit... and it sucks! I would love to get my hands on them.....death would be to soft for them!!!!CG

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

The spyware has changed settings in the registry. You will have your job cut out for you to edit the settings if you don't have a Ghost backup or can't recover using a restore point.Perhaps the teckies can help on this one.SRV RonBTY, the Terrorist and officials in North Korea are working on their own training hundreds of hackers to install spyware, worms, and other trash in order to sabatague various computers, servers, and the internet in general.Now, it is more important then ever to keep your firewall and anti virus current and to have even the operating system backed up. It is not a question of if you will be attacked, it is when you will be attacked.

Alert | IP

[ Home | MSTS Forum | MSTS FAQ | How To... | File Library ] Copyright © 2004 by Nels Anderson. All Rights Reserved.