Remove Transponder

What is Transponder ?

Transponder is an IE Browser Helper Object. It monitors web pages requested and data entered into forms, sends this information to its home server, and opens pop-up advertisement windows. It also has the capability to update itself and install other software

Transponder variants

Transponder/Blackstone is controlled by blackstonedata.net; Transponder/VX2 is controlled by vx2.cc; Transponder/TPS108 is controlled by tps108.org. All work very similarly.

Transponder/MSView is an updated version. Its controlling server is still tps108.org, but SSL is now used to communicate with it.

Transponder/Host and Transponder/BI are newer releases under the company name letter Internet? a new name for the same operators and software. These variants are controlled by stop-popup-ads-now.com and abetterinternet.com respectively.

Transponder/SiteHlpr is a variant the behaves similarly to TPS108, but which seems to have been considerably rewritten by another company. Its controlling server is www.bc777.com.

IPInsight/Ipinsigt is another parasite adapted from the Transponder/VX2 codebase.

Transponder behavior

• Stealth Tactics
  
• Connects to the internet
  
• Shows ads
  
• Changes browser
  
• Stays Resident

Transponder Removal Instructions:

Contrary to the continual claims at Transponder web sites there has never been an option to remove the software in the standard "Add/Remove Programs" Control Panel item. Common anti-spyware titles and Ad-Aware 6 should be able to remove most variants of Transponder.

Manual removal
Transponder is a DLL file called IEHelper.dll (Blackstone variant), VX2.dll (VX2 variant), TPS108.dll (TPS108 variant) or MSView.dll (MSView variant). This can be found in the Windows folder.

Before the file can be deleted, it must be deregistered. Open a DOS command prompt window (from Start->Programs->Accessories) and enter the following commands, for the Blackstone variant:

cd "%WinDir%\System"
regsvr32 /u ..\IEHelper.dll
Or, for the VX2 variant:

cd "%WinDir%\System"
regsvr32 /u ..\VX2.dll
Or, for the TPS108 variant:

cd "%WinDir%\System"
regsvr32 /u ..\TPS108.dll
Or, for the MSView variant:

cd "%WinDir%\System"
regsvr32 /u ..\MSView.dll
Or, for the Host variant:

cd "%WinDir%\System"
regsvr32 /u ..\host.dll
Or, for the BI variant:

cd "%WinDir%\System"
regsvr32 /u ..\BI.dll
Or, for the SiteHlpr variant:

cd "%WinDir%\System"
regsvr32 /u ..\SiteHlpr.dll
After doing this and restarting the computer you can delete the DLL file from the Windows folder. In the MSView variant you can also delete MSView.ini in the same place; in the Blackstone variant domlst.cch can be deleted. The Host variant may leave 'hostprep.exe'.

In the TPS108 variant there may be a tps108.html file in the root of the C:\ drive; in the SiteHlpr variant it may be called bc777.html. These can be deleted to clean up.

If you want, you can also clean up the registry (Start->Run->regedit) by deleting the 'Transponder' (Blackstone variant), 'RespondMiter' (VX2 variant), 'TPS108' (TPS108 variant), 'HostDll' (Host variant), 'MSView' (MSView variant) or 'SiteHlpr' (SiteHlpr variant) subkey of HKEY_LOCAL_MACHINE\Software.

Copyright © SpywareDot 2002-2005| spywaredot.com.  All rights reserved.