Realtime Spy kills Ad Aware and Spybot Search and Destroy

[Ron Kinner]

Just want to share some information about Realtime Spy (A keyboard logger which sends its information to a website so you can monitor it remotely). A friend of mine installed it on his own computer because he wanted to see what his kids were up to. It brought up an error message about C:\winnt\winsrc.exe and also killed both Ad Aware and Spybot Search and Destroy and he wanted to get rid of it but didn't know how so he brought it to me. The thing has a lot of stealth technology and did not show up in the Control Panel / Add/Remove Programs nor did it show up in the MSconfig or in any of the usual spots in the registry or win.ini or startup folder. I still don't know how it starts. However a search for files added in the last day showed that a file called ntinvisible.dll had been added down in C:\winnt at the same time as winsrc.exe. I tried renaming both winsrc and ntinvisible but permission was denied. Booted to Safe Mode with Command prompt and was able to rename them. After rebooting, Ad-Aware and Spybot both worked and the error message is gone so I think I killed it. Just thought this information might be useful.

Ron

[Roger Faucher]

Ron:

Thanks for the tip.

Roger

[Ganesh Babu]

Hi Ron,
Thanks for the info.. this really helped one of co-worker home laptop..

One more thanks from my co-worker..

Ganesh

[Danny Khong_1]

Ron, thanks a lot you are really a rare gem. We need more people like you to share without demanding much for a return. Microsoft and many others are too expensive.

[Ramesh Pakkath]

Hi Ron,

At times even Spybot or Adware fails to remove this appliaction. Just an info to manually remove Realtime-Spy from the machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

Stop Running Processes:

Kill these running processes with Task Manager:
programfilesdir+\spytech software\spyanywhere\noserver.exebinkie.exe
rts.exe
rtsconfig.exe
stop-rts.exe

Remove these files (if present) with Windows Explorer:

programfilesdir+\spytech software\spyanywhere\monitoring.htm
programfilesdir+\spytech software\spyanywhere\noserver.exe
programfilesdir+\spytech software\spyanywhere\purchasing.htmbinkie.exe
help documentation.lnk
help.htm
license eula.lnk
read me.lnk
readme!.txt
rts.exe
rtsconfig.exe
stop-rts.exe

Ramesh Pakkath.

[Ron Kinner]

Ramesh,

I don't recognize any of the programs you are talking about so there may be more than one version of Realtime Spy out there but thanks for the info.

Ron

[Ramesh Pakkath]

Your welcome Ron.

[Jay_124]

Does this kill the entire program or just the fact that it blocks spybot and adaware?

[Bruno Ganino]

Thank you Ron,
This notice is very useful !
In fact i use ad-aware.
Thanx again.

Bruno

[Ron Kinner]

Jay, near as I can tell the program is gone. By removing the ntinvisible.dll file I killed the cloaking device so if it were still running I would see it.

Ron