HP, 64-bit rebuilt tower with 850-gig HD and 4 Meg RAM, running Windows
7. Every time lately that I bring up a page, some words such as "lands"
are doubled and highlighted, example _landslands_. If I hover my mouse
over the duplicated words, something comes up that appears to be an ad,
e.g., Land's End
<http://www.bleepingcomputer.com/forums/t/530498/windows-7-and-torntv/?hl=%2Btorntv#>
or some real estate agency in California. (I live in southeast Ohio!
LOL) Sometimes just the logo of the TornTV comes up, which reads Click
to continue > by Torntv V9.0.
I Googled TornTV and it turns out it is in fact malware -- which is
untouched by Malwarebytes, M$ Security Essentials, or adwcleaner. A
look at the Registry
<http://www.bleepingcomputer.com/forums/t/530498/windows-7-and-torntv/?hl=%2Btorntv#>,
HKEY_LOCAL_Machine... Windows... Current Version... Run reveals the
following information:
(Default) REG_SZ (Value not set)
HotKeyCmds REG_SZ C:\Windows\system32\hkeycmd.exe
IgfxTray REG_SZ C:\Windows\system32\igfxtray.exe
MSC REG_SZ C:\Program Files\Microsoft
Security Client\msseces.exe -hide -runkey
Persistence REG_SZ C:\Windows\system32\igfxpers.exe
picon REG_SZ "C:\Program Files
(x86)\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe" -startup
So my question is, do all these "belong?" If not, do I remove the value
Persistence, that being the one I'm in doubt about? I looked on some
virus and adware removal sites but only found one,
http://www.go-remove-malware.com/how-to-remove-torntv/ Can I trust
this site?
TIA; you folks are always a great help!
Joyce
SE Ohio
PCSOFT's List Owners:
Bob Wright<[log in to unmask]>
Mark Rode<[log in to unmask]>
|