Spy ware and TSA

Richard · Dec 5, 2004

Hello!

My apologies if this is outside the remit of this list but I had the
misfortune to get some spy ware on my win 2k machine today, and although
I have rid myself of most of it I still am having problems with two
items.

The first item is a programme that I am suspicious of in my programmes
list. This is called TSA and searches on Google are not that helpful
but I fear it is bad news. The second problem is the removal of a file
called sfbho.dll and this is part of Side Find. I cannot remove it
because I am told windows is using it.

Thanks if anyone can help me along on this

Cheers

Richard
--

David H. Lipman · Dec 5, 2004

1) Download the following item...

Adaware SE (Free personal version)
http://www.lavasoftusa.com/

2) Update Adaware with latest definitions.
3) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode
5) Using Adaware SE, perform a Full Scan of your platform and clean/delete
any parasites found.
6) Restart your PC and perform a "final" Full Scan of your platform using Adaware
7) If you are using WinME or WinXP,Re-enable System Restore and re-apply any
System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) If you are using WinXP, create a new Restore point

* * * Please report back your results * * *

Dave

| Hello!
|
| My apologies if this is outside the remit of this list but I had the
| misfortune to get some spy ware on my win 2k machine today, and although
| I have rid myself of most of it I still am having problems with two
| items.
|
| The first item is a programme that I am suspicious of in my programmes
| list. This is called TSA and searches on Google are not that helpful
| but I fear it is bad news. The second problem is the removal of a file
| called sfbho.dll and this is part of Side Find. I cannot remove it
| because I am told windows is using it.
|
| Thanks if anyone can help me along on this
|
| Cheers
|
| Richard
| --
|

Richard · Dec 6, 2004

David H. Lipman said:
1) Download the following item...

Adaware SE (Free personal version)
http://www.lavasoftusa.com/

2) Update Adaware with latest definitions.
3) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode
5) Using Adaware SE, perform a Full Scan of your platform and clean/delete
any parasites found.
6) Restart your PC and perform a "final" Full Scan of your platform
using Adaware
7) If you are using WinME or WinXP,Re-enable System Restore and
re-apply any
System Restore preferences, (e.g. HD space to use suggested 400
~ 600MB),
8) Reboot your PC.
9) If you are using WinXP, create a new Restore point

* * * Please report back your results * * *

Dave

Dear David

Many thanks for your excellent advise. Just got finished with the
"programme" and now all seems clean as the preverbal whistle! The
entry in programmes under control panel still shows an application TSA,
however now instead of it showing a size of about 12Mb is shows it as
not having any size. This feels good and so perhaps I just remove the
entry? What is TSA anyway? I'm sure you would know.

Many thanks again for getting me out of the S**t.

Richard

David H. Lipman · Dec 6, 2004

Hi Richard:

Glad to hear it did the job.

The only way to remove TSA from add/remove software would be to remove it from the Registry.
If your not experienced with the Registry. Ignore the entry.

What is TSA ? -- I have no idea.

Dave

| In message <uwMsd.364$MS6.340@trndny01>, David H. Lipman
| >1) Download the following item...
| >
| > Adaware SE (Free personal version)
| > http://www.lavasoftusa.com/
| >
| >2) Update Adaware with latest definitions.
| >3) If you are using WinME or WinXP, disable System Restore
| > http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
| >4) Reboot your PC into Safe Mode
| >5) Using Adaware SE, perform a Full Scan of your platform and clean/delete
| > any parasites found.
| >6) Restart your PC and perform a "final" Full Scan of your platform
| >using Adaware
| >7) If you are using WinME or WinXP,Re-enable System Restore and
| >re-apply any
| > System Restore preferences, (e.g. HD space to use suggested 400
| >~ 600MB),
| >8) Reboot your PC.
| >9) If you are using WinXP, create a new Restore point
| >
| >
| >* * * Please report back your results * * *
| >
| >Dave
|
| Dear David
|
| Many thanks for your excellent advise. Just got finished with the
| "programme" and now all seems clean as the preverbal whistle! The
| entry in programmes under control panel still shows an application TSA,
| however now instead of it showing a size of about 12Mb is shows it as
| not having any size. This feels good and so perhaps I just remove the
| entry? What is TSA anyway? I'm sure you would know.
|
| Many thanks again for getting me out of the S**t.
|
| Richard
| --
| Richard Kenward www.precision-drum-scanning.co.uk
|
|

rjdriver · Dec 6, 2004

TSA is a trojan.

Get the Tweakui for your OS to remove entires from Add/Remove Programs for
apps that have been removed by other means.

Bob

David H. Lipman · Dec 6, 2004

Bob:

I have TwealUI v1.33 and use it with ALL MS OSs (Win9x/ME, NT4, Win2K, WinXP and Win2003
server). It does not provide a way to remove software listed in the "Add/Remove Programs"
Control Panel applet.

There is a separate version that will only allow itself to be installed on WinXP. I don't
know if that version has that capability. However, I do know that v1.33 of TweakUI does
not.

Dave

| TSA is a trojan.
|
| Get the Tweakui for your OS to remove entires from Add/Remove Programs for
| apps that have been removed by other means.
|
| Bob

Richard · Dec 6, 2004

David H. Lipman said:
Hi Richard:

Glad to hear it did the job.

The only way to remove TSA from add/remove software would be to remove
it from the Registry.
If your not experienced with the Registry. Ignore the entry.

What is TSA ? -- I have no idea.

Dave

Dear Dave

I am happy with messing around in the registry but could not see any
entries for TSA...is there any danger in leaving the entry showing up in
programmes when you go to the remove programmes in control panel?

I did notice in the registry that there was an entry called sais in
lower case. Did not sound right and am suspicious!

Cheers

Richard

--

David H. Lipman · Dec 6, 2004

Richard · Dec 6, 2004

David H. Lipman said:
You can leave the Registry as is. No problems.

Dave

Dear Dave

Thanks for that. Can I ask you though what would the entry sais stand
for in the software lists? I am now a little bit jittery!

Cheers

Richard

snip

rjdriver · Dec 6, 2004

David H. Lipman said:
Bob:

I have TwealUI v1.33 and use it with ALL MS OSs (Win9x/ME, NT4, Win2K, WinXP and Win2003
server). It does not provide a way to remove software listed in the "Add/Remove Programs"
Control Panel applet.

There is a separate version that will only allow itself to be installed on WinXP. I don't
know if that version has that capability. However, I do know that v1.33 of TweakUI does
not.

Dave

Try v2.11.
http://www.microsoft.com/windowsxp/downloads/powertoys/xppowertoys.mspx

Bob

bassbag · Dec 6, 2004

Dear David

Many thanks for your excellent advise. Just got finished with the
"programme" and now all seems clean as the preverbal whistle! The
entry in programmes under control panel still shows an application TSA,
however now instead of it showing a size of about 12Mb is shows it as
not having any size. This feels good and so perhaps I just remove the
entry? What is TSA anyway? I'm sure you would know.

Many thanks again for getting me out of the S**t.

Richard

Most control panel entries are .cpl files originating usually from windows
system/32 folder.search for tsa.cpl in find files or broaded to *.cpl
files.Right clicking the suspected .cpl file and selecting properties
usually gives you information on the files origin and you can decide whther
to remove or not.
me

David H. Lipman · Dec 6, 2004

David H. Lipman · Dec 6, 2004

That's what I thought. The WinXP Specific version. I prefer the generic version.

Dave

|
|
| Try v2.11.
| http://www.microsoft.com/windowsxp/downloads/powertoys/xppowertoys.mspx
|
|
|
| Bob

Roger Wilco · Dec 7, 2004

Richard said:
I am happy with messing around in the registry but could not see any
entries for TSA...

Win98 and Ad-aware 5.8 in my add/remove programs app - to remove or change how it appears in the app's listing I
go to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ad-aware 5.8 and remove
the key "DisplayName" (here it is "Ad-aware 5.8"). I suppose you could remove the entire key if you want. This is a good
place to find uninstall strings not listed in add/remove also.

Gorf Nimda · Dec 7, 2004

Hi Richard:

Glad to hear it did the job.

The only way to remove TSA from add/remove software would be to remove it from the Registry.
If your not experienced with the Registry. Ignore the entry.

What is TSA ? -- I have no idea.

Dave

if you've got the 'TWeakUI' applet (part of the powertoys for
w9x, me, xp)

you can remove invalid entries from the add/remove dialog easily.

proceed with caution, make sure the entry you remove is the one
you WANT removed.

Spy ware and TSA

Richard

David H. Lipman

Richard

David H. Lipman

rjdriver

David H. Lipman

Richard

David H. Lipman

Richard

rjdriver

bassbag

David H. Lipman

David H. Lipman

Roger Wilco

Gorf Nimda