HOW TO: Remove trojan rlvknlg.exe

[Carlo Gambino]

While installing some audio conversion software, I noticed a new app in the system tray. As I started to research rlvknlg.exe, I noticed the machine to slow exponentially while reading this "marketing tool" is basically a trojan reporting my activity to it's owner.

Now I am mostly a linux user, so perhaps my windows machine is not a secure as it could be. But I was running Norton AV at the time of infection, no firewall or anything like that. After updating Norton's virus definitions, it still didn't recognize this as a threat, so I turned it off. I tested several free trial versions of AV software, finding AVG to be the best for this issue as it located and quarantined all malicious files while in Safe Mode. Once the files were quarantined, I navigated to C:\Program Files where this program made it's home, and manually deleted the folder "Relevant Knowledge" and all of it's contents.

After rebooting, I ran hijackthis to see where things stood, and this little bugger was still reporting. The next step I took, was to install Easy Cleaner and delete the registry keys that were pointing to this program, as well as removing it from the startup program list.

Finally, I installed LSPFix to correct any LSP chains that may have gotten damaged. After another reboot, running hijackthis AND AVG shows no signs. My machine is back running well, and hopefully I've eliminated the threat.

Hope this proves helpful to someone as this cost me 12 hours to diagnose and fix completely and correctly.

Happy Window washing.

[andsome]

It's always useful when people post tips like this. I cannot understand why you don't use a firewall though. I like Nod 32 full security suite, and also run several Anti Malware programs. :D

[Dencandy]

But I was running Norton AV at the time of infection, no firewall or anything like that. After updating Norton's virus definitions, it still didn't recognize this as a threat, so I turned it off.

A number of us on this forum have had similar experiences with Norton AV. It has other drawbacks as well which you are likely to have experienced if you had continued using it. I, too, now use NOD32/ESET & it appears to work very effectively. As well as AVG, there are a number of free anti-virus products which rate higher than Norton AV on third party tests. These include AntiVir & Avast.

I also agree with andsome that with the internet as it is now you definitely need a competent 2-way firewall and an anti-malware product as well as an anti-virus program when using Windows. I would also add an anti-adware product (like Lavasoft's free Ad-Aware). This is so especially if you are downloading software.

Also thanks for the tips about that nasty piece of malware.