Already few days have passed since the Relevant Knowledge globe sits there in the taskbar in Notification area. I was very busy the last few days and I don’t give too much attention to it but today looking at it, I start to ask myself how this globe got there? I don’t remember to got installed anything with that name, Relevant Knowledge for sure a parasitic program and I decided to track back, what program carried it on? Because in my opinion, to install something in a computer without its owner knowledge or agreement is highly immoral and unethical, even more is very dangerous. It’s a logical flow of thoughts, why to hide the actions performed by a program or if it installs something more in the computer, that’s because these extra programs are not desirable by the user or malevolent. We know a lot about computer programs that comes with adware or spyware components embedded, beeing a real threat to the user privacy, in fact a real threat to his cyber-life.
I compare the computer with a virtual home, nobody wants to live in the house with someone sitting under the bed spying all of his movements and waiting for the right time to break the safe-box for example. I’m not exagerating, I know things like compromised email or online banking accounts happens all the time despite the users thinks they are fully impenetrable protected. As a matter of fact this is the biggest danger, to think you are 100% protected, it does not matter what antivirus solution you run.
I was very curious what program was piggybacking this misterious program Relevant Knowledge so I started to look in Program Files directory for the program installation folder and its creation date. It was created several days ago somebody asked me to make a wmv file playable on a PS3 and I was testing some freeware video converters. Looking for files(in Temp directory, Program Files directory, Temporary Internet Files) with a creation date close to the Relevant Knowledge folder, all the tracks was leading to Leawo Free AVI Converter as the main suspect so I reinstalled it this time sandboxed and monitoring all the actions performed by the program. To achieve this I’ve used Sandboxie with BSA add-on, my favourite tools for analysis.
When the installation started :
two folders appears in the %currentuser%\Local Settings\Temp directory, one containing a file avi2video_install.tmp and the other 3 files :
- rkverify.exe -268 KB -Company: TMRG, INC. -MD5: 020CE95075F8C93E6CC957953D7F4589
- LogFile.dll -227 KB
- EncStr.dll -397 KB
The next screen is a message about offering Relevant Knowledge software :
So there is a message about installing Relevant Knowledge, therefore I can not say its installation is hidden but simply when I installed first time the video converter, I did not pay too much attention to this window. It’s a learned lesson, always take the time to read carefully the messages and License Agreement preceding a software installation. I’m sure my mistake is very common amongst the computer users.
After the License Agreement and the installation procedure a short survey was following :
and the Relevant Knowledge program start to act. There is a long list of URLs where the program connects some of them very weird and scaring because I saw the program connecting to some of the sites where I was logged in before:
[ Network services ]
* Looks for an Internet connection.
* Backdoor functionality on port 0.
* Connects to “post.securestudies.com” on port 80.
* Connects to “165.193.78.234” on port 443.
* Connects to “91.209.196.174” on port 80.
* Connects to “” on port 80.
* Connects to “127.0.0.1” on port 6323.
* Connects to “www.relevantknowledge.com” on port 80.
* Connects to “165.193.78.245” on port 80.
* Connects to “165.193.78.234” on port 80.
* Connects to “oss-content.securestudies.com” on port 80.
* Connects to “66.119.33.170” on port 80.
* Connects to “insider.msg.yahoo.com” on port 80. <== The program connects to yahoo.com in my account maybe???
* Connects to “67.195.186.236” on port 80.
* Connects to “217.146.187.123” on port 443.
* Connects to “93.184.220.29” on port 80.
* Connects to “www.whatismyip.com” on port 80.
* Connects to “72.233.89.199” on port 80.
* Connects to “cnfg.facemoods.com” on port 80.
* Connects to “70.38.71.104” on port 80.
* Connects to “xxxxx.com” on port 80. <== here was one of my sites where I was logged in before.Why it connects there ???And how, maybe using the saved cookies ?
* Connects to “46.102.241.179” on port 80.
* Connects to “www.dvd-ppt-slideshow.com” on port 80.
* Connects to “173.244.164.35” on port 80.
* Connects to “cleanbytes.net” on port 80. <== you can see here the program connects to this site cleanbytes.net, but why and how?
* Connects to “173.193.32.144” on port 80.
* Connects to “player.play.it” on port 80.
* Connects to “81.196.26.161” on port 80.
* Connects to “www.leawo.com” on port 80.
* Connects to “www.google.com.tr” on port 80.
* Connects to “74.125.87.104” on port 80.
* Connects to “cdn-aws.mywot.net” on port 80.
* Connects to “216.137.61.67” on port 80.
* Connects to “www.mywot.com” on port 80.
* Connects to “217.149.52.196” on port 80.
According to Sandboxie add-on BSA, the software enumerates the running processes, enable process privileges and has keylogger functionality. Also the program creates a lot of processes and mutexes :
Created an event named: CS_CONFIDENCE_COMPLETE
Created an event named: DisableLowDiskWarning
Created an event named: MSCTF.SendReceive.Event.EMP.IC
Created an event named: MSCTF.SendReceive.Event.IEB.IC
Created an event named: MSCTF.SendReceive.Event.INK.IC
Created an event named: MSCTF.SendReceiveConection.Event.EMP.IC
Created an event named: MSCTF.SendReceiveConection.Event.IEB.IC
Created an event named: MSCTF.SendReceiveConection.Event.INK.IC
Created an event named: OSSListening
Created an event named: OSSProxyShutdownEvent
Created an event named: OSSProxyUpgradeEvent
Created an event named: OSSProxyUpgradeMenuEvent……………………………………………………………………………
Created process: (null),netsh firewall add allowedprogram program = “c:\program files\relevantknowledge\rlvknlg.exe” name = rlvknlg.exe mode = ENABLE scope = ALL,(null) <== add a rule to the firewall
………………………………………………………………………………Defined registry AutoStart location added or modified: machine\software\Classes\clsid\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}\CLSID = {64697678-0000-0010-8000-00AA00389B71}
Defined registry AutoStart location added or modified: machine\software\Classes\clsid\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}\FilterData = …Defined registry AutoStart location added or modified: user\current\software\Microsoft\Windows\CurrentVersion\RunOnce\OSSProxy = c:\program files\relevantknowledge\rlvknlg.exe -bootinstall
Detected backdoor listening on port: 0
Detected keylogger functionality
Detected process privilege elevation
Enumerated running processes
IE settings change: user\current\software\microsoft\internet explorer\main\windowssearch\version = ws not installed………………………………………………………………………………….
Opened a service named: LanmanServer
Opened a service named: NapAgent
Opened a service named: RASMAN
Opened a service named: RemoteAccess
Opened a service named: Router
Opened a service named: SensRisk evaluation result: High
To do its job, the software use a proxy named OSS proxy, to disable it seems to be enough to delete this registry key :
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\OSSProxy
The installation directory contained 2 files:
*rlvknlg.exe by TMRG, INC. -MD5 983021B2913EA68DA2E4F0FC9E09A8AB
and
*rlservice.exe by TMRG, INC. MD5 4B2D9D2DD644BE510E9AC7121EDD6D71
Disassembling rlvknlg.exe with IDA Pro Disassembler reveal other interesting facts :
.rdata:005EE82C aActivityLoadho db ‘Activity::LoadHookDLL: (%d) %s’,0Dh,0Ah,0
.rdata:005EE82C ; DATA XREF: sub_4046E9+1A0o
.rdata:005EE84D align 10h
.rdata:005EE850 ; char aActivityEnable[]
.rdata:005EE850 aActivityEnable db ‘Activity: Enabled keyboard hooks (%p)’,0Dh,0Ah,0
.rdata:005EE850 ; DATA XREF: sub_4048CB+A9o
.rdata:005EE878 ; char aActivityEnab_0[]
.rdata:005EE878 aActivityEnab_0 db ‘Activity: Enabled mouse hooks (%p)’,0Dh,0Ah,0
.rdata:005EE878 ; DATA XREF: sub_4048CB+D8o
.rdata:005EE89D align 10h
.rdata:005EE8A0 ; char aActivityEnab_1[]
.rdata:005EE8A0 aActivityEnab_1 db ‘Activity: Enabled shell hooks (%p)’,0Dh,0Ah,0
.rdata:005EE8A0 ; DATA XREF: sub_4048CB+107o
.rdata:005EE8C5 align 4
.rdata:005EE8C8 ; char aActivityEnab_2[]
.rdata:005EE8C8 aActivityEnab_2 db ‘Activity: Enabled message hooks (%p)’,0Dh,0Ah,0
.rdata:005EE8C8 ; DATA XREF: sub_4048CB+136o…………………………………………………………………………………………..
char aSkypecontrol_0[]
.rdata:005E3174 aSkypecontrol_0 db ‘SkypeControlAPIAttach‘,0 ; DATA XREF: sub_579CF1+18o
.rdata:005E318A align 4
.rdata:005E318C ; char aSkypecontrolap[]
.rdata:005E318C aSkypecontrolap db ‘SkypeControlAPIDiscover‘,0 ; DATA XREF: sub_579CF1+8o
.rdata:005E31BC aSkype_exe db ‘Skype.exe‘,0 ; DATA XREF: sub_57A140+7Co
.rdata:005E31C6 align 4
.rdata:005E31C8 aGetCurrentuser db ‘GET CURRENTUSERHANDLE‘,0 ; DATA XREF: sub_57AAB0+4Fo
.rdata:005E31DE align 10h
.rdata:005E31E0 ; char aActivemembers[]
.rdata:005E31E0 aActivemembers db ‘ ACTIVEMEMBERS ‘,0 ; DATA XREF: sub_57AB35+5DCo
.rdata:005E31E0 ; sub_57AB35+6CCo …
.rdata:005E31F0 ; char aChat[]
.rdata:005E31F0 aChat db ‘CHAT ‘,0 ; DATA XREF: sub_57AB35+5C4o
.rdata:005E31F0 ; sub_57AB35+6B0o
.rdata:005E31F6 align 4
.rdata:005E31F8 aGetChat db ‘GET CHAT ‘,0 ; DATA XREF: sub_57AB35+526o
.rdata:005E3202 align 4
.rdata:005E3204 aActivemember_0 db ‘ ACTIVEMEMBERS’,0 ; DATA XREF: sub_57AB35+513o
.rdata:005E3213 align 4
.rdata:005E3214 aChatname_1 db ‘CHATNAME ‘,0 ; DATA XREF: sub_57AB35+4E3o
.rdata:005E321E align 10h
.rdata:005E3220 ; char aChatname_0[]
.rdata:005E3220 aChatname_0 db ‘CHATNAME’,0 ; DATA XREF: sub_57AB35+4B2o
.rdata:005E3229 align 4
.rdata:005E322C aChatname db ‘ CHATNAME’,0 ; DATA XREF: sub_57AB35+429o
.rdata:005E3236 align 4
.rdata:005E3238 aBody_1 db ‘BODY ‘,0 ; DATA XREF: sub_57AB35+3CCo
.rdata:005E323E align 10h
.rdata:005E3240 aGetChatmessage db ‘GET CHATMESSAGE ‘,0 ; DATA XREF: sub_57AB35+2BBo
.rdata:005E3240 ; sub_57AB35+438o
.rdata:005E3251 align 4
.rdata:005E3254 aBody_0 db ‘ BODY’,0 ; DATA XREF: sub_57AB35+2ACo
.rdata:005E325A align 4
.rdata:005E325C ; char aBody[]
.rdata:005E325C aBody db ‘BODY’,0 ; DATA XREF: sub_57AB35+1BCo
.rdata:005E3261 align 4
.rdata:005E3264 ; char aStatusSent[]
.rdata:005E3264 aStatusSent db ‘STATUS SENT‘,0 ; DATA XREF: sub_57AB35+19Fo
.rdata:005E3270 ; char aMessage[]
.rdata:005E3270 aMessage db ‘MESSAGE ‘,0 ; DATA XREF: sub_57AB35+181o
.rdata:005E3270 ; sub_57AB35:loc_57AD38o
.rdata:005E3279 align 4
.rdata:005E327C ; char aChatmessage[]
.rdata:005E327C aChatmessage db ‘CHATMESSAGE ‘,0 ; DATA XREF: sub_57AB35+168o
.rdata:005E327C ; sub_57AB35+1FCo
.rdata:005E3289 align 4
.rdata:005E328C ; char aCurrentuserhan[]
.rdata:005E328C aCurrentuserhan db ‘CURRENTUSERHANDLE ‘,0
.rdata:005E328C ; DATA XREF: sub_57AB35:loc_57AC79o
.rdata:005E328C ; sub_57E557+53o
.rdata:005E329F align 10h
.rdata:005E32A0 aGetCall db ‘GET CALL ‘,0 ; DATA XREF: sub_57AB35+C2o
.rdata:005E32AA align 4
.rdata:005E32AC aPartner_handle db ‘ PARTNER_HANDLE’,0 ; DATA XREF: sub_57AB35+AFo
.rdata:005E32BC ; char aInprogress[]
.rdata:005E32BC aInprogress db ‘INPROGRESS’,0 ; DATA XREF: sub_57AB35+36o
.rdata:005E32C7 align 4
.rdata:005E32C8 ; char aCall[]
.rdata:005E32C8 aCall db ‘CALL ‘,0 ; DATA XREF: sub_57AB35+1Ao
………………………………………………………………………….char aAdviewdataSe_0[]
.rdata:005EF150 aAdviewdataSe_0 db ‘AdViewData::SendDataToServer, uploaded screenshot to ad server.’,0Dh
.rdata:005EF150 ; DATA XREF: sub_411294:loc_4118D7o
……………………………………………………………………………….char aInitializingBr[]
.rdata:005F19E0 aInitializingBr db ‘Initializing BrowserMonitor‘,0Dh,0Ah,0.rdata:005F1E08 aBrowsermoni_16 db ‘BrowserMonitor: Checking %s,%s for survey‘,0Dh,0Ah,0
.rdata:005F1E08 ; DATA XREF: sub_42BEFE+86oaRequestid0x0_8 db ‘RequestID 0x%08X: AOL traffic check %s (%s)’,0Dh,0Ah,0
.rdata:005F40C0 ; DATA XREF: sub_435F72+416o
.rdata:005F40EE align 10h
.rdata:005F40F0 aConnectionEsta db ‘Connection Established‘,0 ; DATA XREF: sub_435F72+471o
.rdata:005F4107 align 4
.rdata:005F4108 ; char aRequestid0x0_9[]
.rdata:005F4108 aRequestid0x0_9 db ‘RequestID 0x%08X: Live365 traffic check %s (%s)’,0Dh,0Ah,0aTopspeed_pro_0 db ‘topspeed.proxy.https’,0 ; DATA XREF: sub_43940A+42Fo
.rdata:005F4DD1 align 4
.rdata:005F4DD4 ; char aSslTrafficForA[]
.rdata:005F4DD4 aSslTrafficForA db ‘SSL traffic for AOL SE client will be tunnelled to %s‘,0Dh,0Ah,0
.rdata:005F4DD4 ; DATA XREF: sub_43940A+49Co
.rdata:005F4E0C ; char aClientconne_21[]
.rdata:005F4E0C aClientconne_21 db ‘ClientConnectionThread 0x%08X, RTMP over port 80 detected.’,0Dh,0Ah,0
.rdata:005F63B0 aSurveyrulesurl db ‘SurveyRulesURL‘,0
.rdata:005F63BF align 10h
.rdata:005F63C0 aHttpRules_s_24 db ‘http://rules.securestudies.com/oss/rule1.asp’,0
.rdata:005F63ED align 10h
.rdata:005F63F0 aRemoteconfigur db ‘RemoteConfigURL’,0
.rdata:005F6400 aHttpRules_s_25 db ‘http://rules.securestudies.com/oss/rule16.asp’,0.rdata:005F64F8 aMousetrackru_0 db ‘MouseTrackRulesURL‘,0
.rdata:005F650B align 4
.rdata:005F650C aHttpRules_s_29 db ‘http://rules.securestudies.com/oss/rule7.asp’,0
.rdata:005F6539 align 4
.rdata:005F653C aBiometricrul_3 db ‘BioMetricRulesURL‘,0
.rdata:005F654E align 10h
.rdata:005F6550 aHttpRules_s_30 db ‘http://rules.securestudies.com/oss/rule21.asp’,0
.rdata:005F657E align 10h
.rdata:005F6580 aLoggingrulesur db ‘LoggingRulesURL‘,0
.rdata:005F6590 aHttpRules_s_31 db ‘http://rules.securestudies.com/oss/rule3.asp’,0
.rdata:005F6E84 aDownloadedOsaF db ‘Downloaded OSA file from: %s‘,0
.rdata:005F6E84 ; DATA XREF: sub_442ACE+FBo
.rdata:005F9D80 aBankofamerica_ db ‘bankofamerica.com‘,0 ; DATA XREF: sub_469119+E2o
.rdata:005F9D80 ; sub_48AB66:loc_48B7EFo ….rdata:005FE684 ; char aMailproxy[]
.rdata:005FE684 aMailproxy db ‘MailProxy’,0 ; DATA XREF: sub_491E88:loc_492A58o
.rdata:005FE684 ; sub_4A276C+7BAo
.rdata:005FE68E align 10h
.rdata:005FE690 ; char aEvsMailproxySe[]
.rdata:005FE690 aEvsMailproxySe db ‘EVS: MailProxy setting removed.’,0Dh,0Ah,0
.rdata:005FE690 ; DATA XREF: sub_491E88+BF6o
.rdata:005FE6B2 align 4
.rdata:005FE6B4 ; char aEvsErrorUnab_0[]
.rdata:005FE6B4 aEvsErrorUnab_0 db ‘EVS: Error – Unable to delete MailProxy setting!’,0Dh,0Ah,0
.rdata:005FE6B4 ; DATA XREF: sub_491E88+C27o
.rdata:005FE6E7 align 4
.rdata:005FE6E8 ; char aEvsMailproxy_0[]
.rdata:005FE6E8 aEvsMailproxy_0 db ‘EVS: MailProxy setting not found.’,0Dh,0Ah,0
.rdata:005FE6E8 ; DATA XREF: sub_491E88:loc_492AD9o
.rdata:005FE70C ; char aEvsDeletingAol[]
.rdata:00601098 aCachePoisonP_0 db ‘Cache Poison Ping: Successfully sent cache poison ping with url ‘
.rdata:00601098 ; DATA XREF: sub_4A4970+2ECo.rdata:0060B6F0 aWininetrequ_10 db ‘WinInetRequest: Content-Type [%s]‘,0Dh,0Ah,0
.rdata:0060B6F0 ; DATA XREF: sub_507A72+39Fo
.rdata:0060B714 ; char aWininetrequ_11[]
.rdata:0060B714 aWininetrequ_11 db ‘WinInetRequest: Read %d bytes‘,0Dh,0Ah,0
.rdata:0060B714 ; DATA XREF: sub_507A72+3DAo
.rdata:0060B734 asc_60B734: ; DATA XREF: sub_5BEDE0+59o
The list with procedures and functions used by Relevant Knowledge is long and just looking at them is scaring enough. The program seems to serve surveys and advertisement to the users along with closely spying their behaviour on the Internet. I don’t know what to say more, I don’t know who in all of his minds wants this program installed in the computer, so my advice is to get rid of it as quick as possible. I don’t say Relevant Knowledge software steal some confidential informations from the computer users either I can not say it’s a hidden install since there is a message at the beginning of installation(even wrote with small small letters) but seems to be ready for serving unwanted advertisements and surveys and it looks like a very high security risk for the users.
Uninstall it from the Remove Programs tab in Control Panel, delete all of the remaining files and folders from Program Files directory and clean the registry for all the remaining keys. How to do this ? Just use Process Explorer from Sysinternals, now microsoft.com and be sure no Relevant Knowledge components(OSS proxy, rlvknlg.exe, rlservice.exe, rlls.dll, rk.osa) are running and Autoruns to determine what programs and services run at start-up and delete all the references to Relevant Knowledge. Both are free, light and very efficient programs.
And, as a last recomandation, always take the time to read the messages preceding a program installation and you will not have nasty surprises. This program, Leawo Free AVI Converter is free as the title says but with what price ?
Keep safe !
Very helpful and informative article, thanks.
John, thanks so much for the very thorough post. My internet browser (Firefox) came to an almost complete halt recently, and at first I thought it had to do with my installation of Kaspersky Pure. But fortunately, Kaspersky warned me of a virus threat related to Relevant Knowledge. After searching Google for some information, I read your post and realized that I too had recently upgraded (fresh install) my Leawo Free AVI Converter and had paid the price. All I needed was the Control Panel uninstall, though I did use Process Explorer and Autoruns to verify that it was gone. Firefox has instantly gone back to speedy service. I am grateful for your work and wanted to comment publicly to thank you. Dave
Thanks for the post!, i have installed an App called Chit Chat Facebook and this “relevant knowledge” thing was in it. when i tried to connect to internet, windows firewall asks me about R.K. and i haven’t a clue of when i had installed that thing…but now it’s gone 😀 thank you again Jonh!
Thanks for your post. As you say, I shall be taking a closer look at accepting things,
instead of just ticking the box. It did cross my mind for moment, that I was ticking the same thing twice. This ‘Relevant knowledge’ spyware, piggybacked into my system on a little application called ‘video cutter’, lucky for me, AVG free gave me a warning. Googled to see what the threat was, seems it just reports home, on what sites I visit and ‘that is all” Well that is plenty enough! I don’t care if I did tick the box, this is beyond the pale. I now have to spend time digging it out… Thanks again for your report.
David Me again. Well I gave up, and did a system restore, and everything is back to normal.
This spyware is nasty. It might seem harmless but it is not. Once it gets a chance to phone home, for it’s update, it does things like put a padlock on its program folder! Forget about trying to use delete program, you’ll just get a message that your system can’t find it. If you try to delete it manually, which is not a good idea, as it is just taking the head off, and leaving behind body, you will get a message that you don’t permission to delete! Or that another application is using the file (not true). Using the application, ‘Everything’, which FINDS everything, many quoted references couldn’t be found in the registry etc… So it is hiding itself better. Besides, it grew to 5MB before I did system restore, so there is a lot of it spread about. Don’t turn off your computer till, it is clear, I dread to think what a restart would do to further entrench itself. Used firewall to block it from the web. Doesn’t the terms relevant knowledge sound mocking after awhile. Who ever put this together, deserves a very hot spot in hell. Thanks be to system restore, it has gotten me out of many a jam, and the hard drive made plenty of noise as it rebuilt itself to what it was 6 days ago. Another lesson learnt is to create a restore point, before installing any new software…. Good luck to everyone else in removing this spyware.
Thanks, quite helpful article. I got relevantknowledge from some other free converter tool. After uninstalling the converter, relevant knowledge was left behind. Very evil!
Very helpful article. I got relevantknowledge from MKVPlayerSetup.exe.Thank you.
I don’t post regularly messages anywhere, but I must break this rule to congratulate you for this very good article and detailed explanations about the procedure you used to reach your conclusions. It provides your article a lot of strength. I wish there was more such articles on the web. Let’s hope many will read you and hopefully react accordingly.
Relevantknowledge is not a virus. It is a rescerch software. If you find it annoying, you can uninstall it from control panel. You can read more about this software on their website relevantknowledge.com
I have seen people complaining about it but? honestly speaking it’s not a virus. The software is used to measure online activity. I also thought it to be a virus initially but then found their website relevantknowledge.com. I did not have any problem in uninstalling it.
Thanks John, great post!
yeah right jonejan98 or how many names you have…. are you sure you are not working for that site and there spyware programs? this is your passion to wright on every site that it`s telling the truth about this spyware?
great article.
ex: “Relevantknowledge is not a virus said…
Relevantknowledge is not a virus. It is a genuine software. If you find it annoying, you can uninstall it from control panel. You can read more about this software on their website relevantknowledge.com
I think spyware is not the right term becasuse software is installed with user’s knowledge and permission and can be removed easily using uninstall program from the control panel. It’s not malicious. It is just a program that gathers some information about user’s browsing habits. It is a genuine piece of software.
January 16, 2012 1:42 AM
Anonymous said…
Relevantknowledge is not a virus. It is a genuine software. If you find it annoying, you can uninstall it from control panel. You can read more about this software on their website relevantknowledge.com”
( http://deletemalware.blogspot.com/2011/04/remove-relevant-knowledge-uninstall.html)
how can you live with yourself?
thnx again for the article. because of that “free” Leawo Free AVI Converter i got this relevantknowldege spyware too
I have seen people complaining about it but? honestly speaking it’s not a virus. The software is used to measure online activity. I also thought it to be a virus initially but then found their website relevantknowledge.com. I did not have any problem in uninstalling it.
Yeah, the problem arises when it measures your activity without your knowledge, that’s a privacy violation.
RelevantKnowledge is not really a virus. And the other day I came home to find some guy sitting on my sofa eating popcorn. But he bought the popcorn himself, so he wasn’t really a burglar.
Relevantknowledge is not a malicious program. You can uninstall it if it’s bothering you. It installs with user’s permission and collects information through surveys. User is rewarded for taking part in the survey. If you need more information, visit their website @ relevantknowledge.com. Wes Atherton
Relevant Knowledge Support Team
RelevantKnowledge is not virus. It is a research software that is installed with user’s permission and can be uninstalled from the control panel. It relies on its members to gain valuable insight into Internet trends and behavior. Read more about it on our website http://www.relevantknowledge.com/faq.aspx. Users are asked to participate in periodic surveys – completely voluntary – and may be rewarded for their participation. Also, by participating users take part in a good cause: RelevantKnowledge donates a tree for every user’s participation. It’s easy to uninstall it if you are not satisfied. If you have any questions, we encourage you to contact us at https://www.relevantknowledge.com/supportform.aspx
Thank you,
Relevant Knowledge Customer Support Team
Please be assured that comScore, the parent company of RelevantKnowledge, has invested substantial resources in making our data collection and privacy practices the best they can possibly be. Our company adheres to industry-accepted best practices regarding the collection and secure storage of the data collected by software such as RelevantKnowledge.
comScore is recognized as a leader in the privacy space by organizations such as the OnlineTrust Alliance, where our co-founder Gian Fulgoni was a panelist earlier this year, along with representatives from the FTC and TRUSTe. (link to http://blog.comscore.com/2012/01/comscore_ftc_and_truste_headline_privacy_town_hall.html).
If you have further questions about RelevantKnowledge, please visit our website: http://www.relevantknowledge.com/faq.aspx
Thank you,
RelevantKnowledge Customer Support Team
I came across RelevantKnowledge in my taskbar today too, and couldn’t for the life of me figure out when I installed it. This article helped quite a great deal. I plan to uninstall it too.
Having programs installed on my machine without my awareness (Because I never installed it) AND saying that they are doing a good friendly job is a kind of craziness. I dug and came through this article. Thanks for the author because that’s what I wanna know.
RelevantKnowledge and your parent comScore “There is no free lunch unless you provide me a free lunch”.
Don’t listen to the person posting from many accounts saying this is not a virus, IT IS!!!!! Even if you uninstall this program in control panel it leaves behind its directory and registry files which continue to function later on, after it is allowed to connect to the internet it locks the folder so you can’t delete it DEFINITIVELY A VIRUS.
Very helful article! I contracted the application while looking for a gif animator and was experimenting with several programs, so I don’t know exactly which one did it. However, the lesson of reading thoroughly any agreements cannot be overemphasized. Be on guard!
at 1st i didn’t know it was a virus cuz i have a ad blocker add-on so i didn’t care abt it until i got intrigued how it get into my computer until i saw this thing. I uninstalled it and its still there in Program Files -_-(R U KIDDIN MEEE). I use Tune Up Utility Shredder. it deleted it except for 1 file…RLLS.DLL. I dunno what it is but i’m sure its dangerous. Now Im finding a way to remove it. like the other comments like on my top. ^.^ BE ON GUARDDD!!!!
.
.
.
.
I WANNA KILL THE MAKER OF THAT THING….ITS LIKE SEX HARASSMENT or IDENTITY THEFT
DUN SCAM US BY SHOWING UR COMMENTS HERE AND PRETEND UR A GOOD GUY. D:<
UR POPULAR ON GOOGLE THAT UR A VIRUS U KNOW SO SHUT UP AND DELETE THAT THING SO NO
ONE WILL be hacked by ur corporations or sumthing
Your comment was also approved so, yes, perhaps I’m a good guy…
This program was installed without my permission and I never got a “survey” such as this guy did once he finished installing. I remember having it a long time ago and removed it, but it some how got back on. Again; I did not see anything about this program or was asked to install it. Nor, was it ever running in my processes or task bar. I’ve yet again, had to remove it.
relevant knowledge is spyware , whoever made this crap is criminal and should be prosecuted .. when u try to quarantine it blocks internet access..
Thank you for the post! Very useful and helpful!
Beaware of ChrisPC softwares! (ChrisPC Free YouTube Downloader Converter, ChrisPC Free Video Converter, ChrisPC Free Anonymous Proxy, …) I got that Relevant Knowledge spyware from them yesterday!
Hopefully, Malwarebytes Antimalware has eradicated it!
i got this nonsense from the MKV player setup
I would just like to thank you for taking the time to write all this for us – it was/is very cool of you to do so! Haven’t figured where I got it but Windows firewall gave me a warning that it had blocked some of its features….I had been noticing something strange about my laptops performance the last couple of days. I installed an alarm clock (Aquarius) and also SpeedFan which monitors the core temps, etc. so it was probably one of them that slid it in..don’t recall any page during install as you indicate above however, being pretty-much brain-dead, I wouldn’t! Thanks again!
I went to their site to find out what it was exactly that appeared out of nowhere…their contact form requests an email address. ONE I did not register an email with them; TWO I did not request to download such annoying services. I do not care what their “Support Team” says, this is a virus! I did not ask for it, and then it goes on to try to obtain an email address in a very dishonest fashion.
Great Post! I was looking for something like this to know about rlvknlg.exe which was installed this morning when I installed a free mp3 recording program from http://www.mp3mymp3.com/. I made the same mistake, just did not pay close attention what I am accepting. It asked for the same survey John Barrett showed.
I saw this kinds of offers with other free software/tools as well. PrimoPDF was one. I downloaded that to join two PDF files but I noticed the agreement of installing their other software at the time of installing PrimoPDF and I declined it.
MY ADVICE is to everyone is to pay more close attention on every single dialog box before hitting or when you install a free tool.
Thanks again.
Mohammed
http://www.mp3mymp3.com/. was also the source of my infection. I’ve known and used this tool on many computers over the years, so to find it’s now packing spyware is a nasty shock. And all you shills claiming it’s “just software” please consider you are defending a piece of deliberately malicious social engineering. You know that most people don’t read the EULA, and the RK start questionnaire is thus assumed to come from the software you are piggybacking. And as many here point out, once RK is running, it’s a resource hog and its actions are scary, and uninstallation is NOT straightforward as you claim. So, to hell with you. However, my biggest beef is that Kaspersky did not categorize this as malware, which it clearly is.
You should probably come through and delete all this obvious disinfo bot spam saying RK is a good thing.
in this soft were can some one imeans the user of this softwere can achive some information about my facebook id meseges which is present on my computer plz some body tell me
can some body ( user of this softwre ) can achive my email or meseges from my facebook id with the help of this softwere????
Theoretically, using this software it could be possible to unveil your Facebook ID.
Thanks man… very useful … i got this through MKV player…
I got this through ChrisPC software, as well, but you should note that you CAN’T uninstall it through control panel – the entry there just RELOADS it, as there is no uninstall and it’s linked to the actual executable, instead. Luckily it’s all contained within it’s installation folder (which you have to edit permissions to), plus a service and an entry in Windows firewall.
I downloaded this when downloading pixelmon/forge for minecraft. WOuld uninstalling change the permissions in the firewall?