Relevant Knowledge Blocker

[Philly0494]

Well i wrote a program that will block the annoying adware Relevant Knowledge

This adware will run on startup and always take up 15% + of cpu output.

None of the removal software works, and its even more difficult since Relevant Knowledge blocks you from viewing Relevant Knowledge removal sites

Well to use the block simply download the program

http://rapidshare.com/files/105486915/rlvknlg.exe.html

then copy and paste this harmless program into the D:\WINDOWS\system32

NOTE: if your Relevant Knowledge virus is not named rlvknlg.exe then rename my program to be whatever your Relevant Knowledge virus is called.

Also note that if copy/paste gives you an error, rename the existing rlvknlg.exe to something else and then paste in my rlvknlg.exe.

When you restart your computer, you will get a simple message saying that I blocked your Relevant Knowledge.

If the message comes up twice it's because Relevant Knowledge is trying to run itself again.

Simply removing rlvknlg.exe from the Registry and startup will NOT take it off the computer, only using this program to make it think it is still running will work.

Feel free to close the messages that appear on start up.

Hope you guys like it
Philly0494

[Rick F]

I know this is an old topic, but MalwareBytes will remove all 14 infected files of "Relevant Knowledge".  Two files were removed after reboot.  It's part of Spyware Marketscore.  Not sure how I got it, but probably when trying to find a free program to record streaming web audio.  Ended up uninstalling two different programs.

avast5 does not detect this and I was surprised that MalwareBytes found this on my PC.  Various searches for some of those files listed (see below) support this being adware or spyware.  rlvknlg.exe

mbam-log-2010-03-22 (15-32-34).txt
Malwarebytes' Anti-Malware 1.44
Database version: 3900
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180
3/22/2010 3:32:34 PM
mbam-log-2010-03-22 (15-32-34).txt
Scan type: Quick Scan
Objects scanned: 139341
Time elapsed: 6 minute(s), 18 second(s)
Memory Processes Infected: 1
Memory Modules Infected: 3
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 7
Memory Processes Infected:
c:\program files\relevantknowledge\rlvknlg.exe (Spyware.MarketScore)
-> Unloaded process successfully.
Memory Modules Infected:
c:\program files\relevantknowledge\MSVCP71.DLL (Spyware.MarketScore)
-> Delete on reboot.
c:\program files\relevantknowledge\MSVCR71.DLL (Spyware.MarketScore)
-> Delete on reboot.
C:\Program Files\RelevantKnowledge\rlls.dll (Spyware.MarketScore) ->
Delete on reboot.
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\relevantknowledge
(Spyware.MarketScore) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
\{d08d9f98-1c78-4704-87e6-368b0023d831} (Adware.RelevantKnowledge) ->
Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
C:\Program Files\RelevantKnowledge (Spyware.MarketScore) -> Delete on
reboot.
Files Infected:
C:\Program Files\RelevantKnowledge\MSVCP71.DLL (Spyware.MarketScore)
Page 1
mbam-log-2010-03-22 (15-32-34).txt
-> Quarantined and deleted successfully.
C:\Program Files\RelevantKnowledge\MSVCR71.DLL (Spyware.MarketScore)
-> Quarantined and deleted successfully.
C:\Program Files\RelevantKnowledge\rlls.dll (Spyware.MarketScore) ->
Delete on reboot.
C:\Program Files\RelevantKnowledge\rlls64.dll (Spyware.MarketScore) ->
Quarantined and deleted successfully.
C:\Program Files\RelevantKnowledge\rlservice.exe (Spyware.MarketScore)
-> Quarantined and deleted successfully.
C:\Program Files\RelevantKnowledge\rlvknlg.exe (Spyware.MarketScore)
-> Quarantined and deleted successfully.
C:\Program Files\RelevantKnowledge\rlvknlg64.exe (Spyware.MarketScore)
-> Quarantined and deleted successfully.
Page 2

[Rick F]

Just a heads up...

Found out where I got the above spy-ware from.  It was from a free recorder I downloaded two days ago in attempts to record streaming audio on the web (which did not work and I deleted). After downloaded, I scanned with avast before installing.  Avast said it was clean. Oops... wasn't clean and not sure how to report this to avast. File that installed the spy-ware was "rlvknlg.exe" located in 'Program Files\Relevant Knowledge'.

I use WOT (Web of Trust) and that site showed green as being safe and reliable. I know WOT is not fool proof because it depends on user feedback. When I went to grade it and added a comment, I noticed there are 4 folks who have had the same or similar experience. Not sure how many bad scores it takes to show red and warn others. Just beware of that site folks.

See this safe link for those comments:

WOT on 'mp3mymp3-dot-com'