How do I uninstall this 'malware' rlvknlg.exe?

[badaughter]

Hi folks - While installing Skype a window poped up on my screen asking to install the 'rlvknlg.exe' program - that I thought was part of Skype. Now I find that it's some kind of malware and I can't get rid of it! Does anyone gone thru this who can help me get this out of my OS?

It would really be a great help!

Thanks a lot -

badaughter

[Boris]

This should fix it :)

See
/>http://www.techsopa.com/vista/how-to-remove-rlvknlgexe-trojan/

I recommend using the free version of Malwarebytes Anti-Malware Free
/>http://www.malwarebytes.org/products/malwarebytes_free

as suggested in the "optional" step there - but do a Full rather than Quick Scan.

[ɹəuəllıʍ ʇɐb]

Just a follow-up question: from where did you download the Skype installer - the Skype website, or a 3rd-party download site?

[bludgard]

I ran into a scareware for XP by the name of ily.exe the other day on a virtual machine and am playing around with it.:lol:

I have several screenshots of the bogus anti-whatever. Anyone cares to take a gander at them see attached .doc.

Forgive me for breaking in on your thread, badaughter, but if the suggestion that Boris has offered fails, come on back.

Well, the .doc was too large. I'll try to get something smaller to post.

I disabled the .exe by renaming the application but I still haven't gotten the VM back to it's original state. I'll get it.

I did manage a screenshot of the offender.

[badaughter]

Just a follow-up question: from where did you download the Skype installer - the Skype website, or a 3rd-party download site?

I got caught by it while Downloading/Installing SKYPE. A lot of this going around,'eh?

IT'S A FREAKIN' MESS!!!

Billy Goodson

[ɹəuəllıʍ ʇɐb]

But did you download it from the Skype website, or did you download it from somewhere else?

I doubt that the Skype website would bundle the installer with malware...

[bludgard]

Just a follow-up question: from where did you download the Skype installer - the Skype website, or a 3rd-party download site?

I got caught by it while Downloading/Installing SKYPE. A lot of this going around,'eh?

IT'S A FREAKIN' MESS!!!

Billy Goodson

Have you tried Boris' suggestion?

These rogue programs may seem to be unbeatable but this is far from the truth. The stress and aggravation they cause is their most powerful weapon. If one could keep reason and logic at hand instead of panicking, there is a solution.

The malware that I mentioned in my previous post has been removed and the VM that was infected is now running almost normal. I spent about 2 hours after posting getting rid of the most intruder.

If you can post a screenshot of all processes running in Task Manager, maybe we can resolve this issue.

Do you get any errors when you try to access the internet? Can you access your machines Security Center?

Basically, after I identified (through Task Manager) and found the ily.exe file (it was hidden in Local Settings>Application Data), I renamed it and rebooted. This broke the registry key rundll32.exe. I then introduced portable SuperAntiSpyware (Malwarebytes would not run) via USB storage device. After removing all that it could, I rebooted and merged rundll32.exe back into the machines registry by the same USB method. The machine is not 100% but I do have control of it and was able to run Malwarebytes (which found 4 more issues). My next step is to run sfc /scannow to see if it will further improve the machines' state.

There is hope. I keep my "real" machines backed up with images of the hard drives in case of this type of tomfoolery. I do not have the time to deal with malware when I need to access school related content and reimaging the machines' HDD only takes about 15-20 minutes (depending on imaging/cloning software used and the size of the drive).

Keep us updated as to how you get on. If you can access TaskManager and are able to post a sreeenshot, I'll be more than happy to help slay this monster.;)

[bludgard]

Infected machine was running better than ever...before I tossed it.:lol:

On to the next one.

I suppose the only 100% sure way to know an ifection isn't present would be to reinstall. Works for me.

Keep us updated if the infection starts spreading. I may want some of that.:0

Edit: A little trick you can use next time you see that little window pop spouting security this and security that. When you first see the window, open TaskManager and kill Internet Explorer. Done. It may be wise to run something like CCleaner right after to clean up any temporary residuals (do not mess with the registry if you can help it).;)