Windows SyncroAd???

oddfish · 2004-09-27, 10:25 AM

This nasty little bastard floated onto my computer and it won't go the fuck away!

It's spyware. It's entitled Windows SyncroAd and it created its own little folder in Program Files which will NOT allow itself to be deleted. On top of that, no matter how many times I try I can't cancel it from MSCONFIG as a startup program. I've run the newest updated versions of Ad-Aware and Spybot, I've also run my VirusScan program a dozen times. Still, there it remains. Little fucker. Plus, I've got another one I can't get rid of. It's called WebRebates. I DON'T WANT ANY FUCKING WEBREBATES! It's an automatic startup program as well, it had it's own folder. I deleted it. I'm going to restart and see if it went bye bye. If it didn't, I'm gonna knife someone in the face

. Anyways, if any of you have any clues as to how to get rid of this little motherfucker, please help me out, cuz this shit's getting annoying. (The little bastard is fucking with internet explorer and making it so that there are constant script errors and shit. Driving me up a fucking WALL!!!)

need help.

Breed · 2004-09-27, 10:55 AM

-----------------------------------------------------------------------------------
Make sure you have viewing of hidden files enabled.

When running HijackThis (scanning and espcially fixing) do not have any browsers open. You had 4 open in your now.txt log.

Use Add/Remove Programs and uninstall SyncroAd, if that does not work then fix the line in your HJT log.

Unless you know that the gam.exe and xss.exe processes are legitimate, follow the below steps to kill and remove them.

Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Find the below process and End it:
gam.exe
xss.exe

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O4 - HKLM\..\Run: [golumm] C:\WINDOWS\System32\golumm\services.exe
O4 - HKCU\..\Run: [sysinit] C:\WINDOWS\System32\golumm\services.exe
O15 - Trusted Zone: *.windupdates.com

Boot in safe mode and use Windows Explorer to delete:
C:\Documents and Settings\Donald\gam.exe
C:\Documents and Settings\Donald\xss.exe
C:\WINDOWS\System32\golumm\services.exe
-----------------------------------------------------------------------------------

Black · 2004-09-27, 11:01 AM

Someone has been lookin at some porno

Breed · 2004-09-27, 11:03 AM

Ok lets look at the "Have You been Looking At Porn Thingy" for oddFish
---------------------------------------------------------
Human? *tick*

"Yes, you have been looking at porno you vile sinner!"
---------------------------------------------------------

Nuthin but cold hard facts right there dewd.

oddfish · 2004-09-27, 11:09 AM

Originally Posted by Black

Someone has been lookin at some porno

i don't need to look at porno, buddy

. i think it snuck in over my portable hardrive when i hooked it up to my roommate's computer to get DeadAIM off of it. The WebRebates one came from some kind of Airline Ticket/Hotel Room site that sells you cheap tickets and hotel rooms and shit. At least that's where i first got the pop up for it. I don't know WHERE this syncro ad shit came from but it's on my portable hard drive. I've already googled it and have gotten essentially no help beyond USE ADAWARE SPYBOT OR SOMETHING ELSE BLAH BLAH BLAH! if anyone else has any ideas or has dealt with this little bug, help'd be appreciated.

EDIT: breed, just reread your post.. the first one you made.. thx.. it worked sorta. lemme just reboot and i'll see if it worked entirely.

Breed · 2004-09-27, 11:11 AM

See my post above.
You'll need to get a copy of HijackThis.

EineBeBoP · 2004-09-27, 11:14 AM

Try the following, only instead of removing the download system, try getting rid of the adware. you might need to improvise and do this in safe mode at some point.

Q: How do I uninstall the Download System?
A: Now why would you want to do that?
No, really. We want to know why so we can make this a better product for you. Before you uninstall, please send us a note explaining why!
Now, on to those uninstall instructions�

STEP 1) Select "Internet Options�" from the "Tools" menu
STEP 2) Click on the "Settings�" button in the Temporary Internet Files section on the "General" tab.
STEP 3) Now click on the "View Objects�" button on the Settings dialog
STEP 4) You'll now be looking at an Explorer window. Look for a file called "FilePlanet Download Control Class" (it should have a FilePlanet icon), right click on it and select "Remove."
If you'd like to install the plug-in again in the future just say, "Yes" when asked to install in the future.