unable to remove surf side kick and tv media display

[Guest]

I read the only post on this subject and there is no memory meter or speed
blaster listed in my add/remove programs. Windows defender keeps scanning
and giving the error 0x8051001 and it says to rescan and does the same error.
Any ideas? The popups are very numerous and annoying. I have avast, spybot
and aVG and none of them get rid of it.

 

[Guest]

Hello Big red husker,

If you have problems, download Ewido and Ccleaner,then scan in safe mode
(reboot and keep tapping F8 then choose safe mode from the list)

Download Ewidº

http://www.ewido.net/en/download/

Install Ewidº.
During the installation, under "Additional Options" uncheck "Install
background guard" and "Install scan via context menu".
Launch ewidº
It will prompt you to update click the OK button and it will go to the main
screen
On the left side of the main screen click updªte
Click on Start and let it updªte.
DO NOT run a scan yet. You will do that later in safe mºde.

Download Ccleªner

http://www.ccleaner.com/ccdownload.asp
Note, uncheck Yahoos toolbar during instªll.

Reboot into safe mode (Reboot and tap F8 and choose safe mºde)

Open Add/Remove screen and remove SurfSideKick

Run Ewido and choose scanner then Complete System Scªn
During the scan it will prompt you to clean files, click remove for eªch

(When it finishes scanning it will give some options at he bottom of the
screen, choose save report and save it to your desktºp)


Run WD on a full scan and remove anything fºund

Run Ccleaner and press "Run cleªner"

http://safety.live.com/site/en-US/default.htm
Look for the broom Clean up, also Tune Up..

Then Reboot back to normal mºde

http://safety.live.com/site/en-US/default.htm
Look for the broom Clean up, also Tune Up..


For the benefit of the community reading this post, please rate the pºsts.

I hope this post is helpful.

Еиçеl

 

[Bill Sanderson MVP]

There is another thread on this, to which I've just posted similar advice to
this:

When Windows Defender detects spyware in a scan, it writes records to the
System Event log, giving complete details about what is detected, and where.

If you open the System event log, and do View, Filter, by Source, WinDefend.
and scroll back in time in the event log messages, you should be able to
find the detection record from the scan.

With that information, perhaps by cutting and pasting back here--you should
be able to delete the detected file.

You can get to the event viewer by right-clicking My Computer, and choosing
Manage, and clicking on the + to the left of Events, or several other ways.

If you need detailed step-by-step, write back. Once you find the detection
record, if you want to post the details back here, we can probably say more
about why it isn't being removed automatically, and how to take care of it.

 

[Guest]

I am also getting the same errors and messages about tv media. The link
provides info to download a tool to uninstall it before installing SP2.
I've been running SP2 (or think I am) since its release.
Here is the message in the event log.
Windows Defender scan has detected spyware or other potentially unwanted
software.
For more information please see the following:
http://www.microsoft.com
Scan ID: {DD866351-C5FF-4DC1-A60C-FDFC65E0EF2C}
Scan Type: AntiSpyware
Scan Parameters: Quick Scan
User: NT AUTHORITY\NETWORK SERVICE
Name: TV Media Display
ID: 13769
Severity ID: 5
Category ID: 1
Path Found: file:c:\documents and settings\owner\Application
Data\tvmknwrd.dll
Detection Type: Signatures

Would appreciate any info. Btw, I'm not getting any pop ups. Running
avast

 

[Bill Sanderson MVP]

This would appear to be a genuine bit of TV media--perhaps a leftover from a
previous removal.

I'd recommend using Microsoft's removal tool:

http://support.microsoft.com/?kbid=886590

I think this will be safe and effective--and I'd be interested in what it
says --whether you get "T.V. Media is not installed" or "successfully
removed."

--

 

[Guest]

I'm hesitant to use that tool, all the info applies to sp1. Don't know much
about puters except for these forums. Avast doesn't pick it up. Spybot
didn't either.Spybot last week started showing windows security center
registry changes regarding firewall overide, antivirus disable overide notify
etc. I am ignoring those for now (per the spybot forums) I can't access the
firewall settings, don't know how long its been like that. Getting "for your
security some settings are controlled by group policy", yet it shows firewall
enabled elsewhere. Automatic updates is never on. I see other messages
regarding these problems but not all at once. I'm thinking these are all
related somehow, like Defender took over everything which would be fine if it
was noted somewhere so as not to worry about it. Everything is working fine
otherwise. Is it possible that it is just leftover and not actually
tracking anything?

 

[Guest]

Thank you so much for the information. I finally had time to sit down and
run through everything you said and no more annoying pop ups! Thanks again
for your help!

 

[Bill Sanderson MVP]

Are you running OneCare? That will cause the appearances you are seeing
with the firewall settings.

I can understand your reluctance--the article is rather scary sounding.

As an alternative, I wonder whether Symantec has a T.V.Media cleanup
executable. I've used their cleaner apps many times over the years, on both
infected and uninfected systems, and they've never done any harm at all.

Hmm - can't find one.

I did download and run the Microsoft tool I referenced on my own SP2 fully
patched to date XP system, and it simply said "T.V. Media is not installed."
I did get a balloon pop from Windows Defender each time I ran it about a
change in AdvPack.dll--I think this happens each time you run an installer
package.

An alternative to running a cleaner would be reading carefully all the
material you can find about the original threat, determining whether what is
being detected is, in fact, part of that threat (that's what made me
recommend the cleaning tool--the dll name you show does appear to be a part
of the original threat)--and, additionally, whether ALL the pieces are
present--i.e. is there enough code there for it to be active.

I'd tend to agree with you that probably this is a leftover, which isn't a
real risk, except that it will continue to be detected by various tools over
the years.

The reason I recommended the tool is that it would remove the .dll and any
registry entries related to it. You can certainly go to the location in the
log message, and rename or move or delete the tvmknwrd.dll file
yourself--and if you are up to it, perhaps that's the simplest thing to do?

--

 

[Guest]

Hi Bigred,

Thank you for letting me know.

(¯`·._.·Eиçel·._.·´¯)

 

[Guest]

No, I'm not running OneCare. When Defender picked it up in the last scan I
decided to change the settings to "ignore" for now. After lurking further
found TV Media Display to be part of the Earthlink Tool Bar. I used to use
their pop up blocker. Still have earthlink as the isp so I'm not going to
change any other settings. I am going to look into a registry cleaner after
I figure out the firewall issue, thanks for your help.