How to Detect & Remove RelevantKnowledge

The information in this article applies to:

Windows XP Professional
Windows XP Home Edition
Windows 2000 Professional

Article ID	:	7473
Last Review	:	Wednesday, January 14, 2009
Revision	:	3.0

INTRODUCTION

A real piece of fine spyware. RelevantKnowledge Any product that employs a user's Internet connection in the background without their knowledge, and gathers/transmits info on the user or their behavior.

SUMMARY

IMPORTANT

How to Detect & Remove RelevantKnowledge

•	Any product that employs a user's Internet connection in the background without their knowledge, and gathers/transmits info on the user or their behavior.
•	Many spyware products will collect referrer info (information from your web browser which reveals what URL you linked from), your IP address (a number that is used by computers on the network to identify your computer), system information (such as time of visit, type of browser used, the operating system and platform, and CPU speed.)
•	Spyware products sometimes wrap other commercial products, and are introduced to machines when those commercial products are installed. See also Adware.

back to the top

How to Detect & Remove RelevantKnowledge

What's RelevantKnowledge?
RelevantKnowledge is a tracking cookie that may monitor your Internet habits and activities and display various surveys in popup windows.

Your response to these popup surveys may be aggregated and may help determine what content you see when you are surfing the web.

RelevantKnowledge may be part of an online market research community. www.RelevantKnowledge.com

As of 2nd of May 2007 using eTrust Anti-Spyware Scorecard v3.0 this pest fails the score card under condition 5 which states:
"Changes to system configuration in any manner without clear notice to the user and obtaining permission at the time of change." RelevantKnowledge changes the firewall configuration by adding itself to the allowed program to run.

Removal:
It is very hard to remove this pest unless the pc is running in safe mode:
once you are in safe mode proceed to remove the following:



HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run 
 relevantknowledge

Dll Files all:



%system%\opls.dll
%system%\ldpackage.dll
rlxf.dll
rlls.dll

Also these registry entries



HKEY_LOCAL_MACHINE\software\relevantknowledge 
HKEY_LOCAL_MACHINE\software\screensaver.com\relevantknowledge
HKEY_CURRENT_USER\oftware\microsoft\windows\currentversion\runonce ossproxy
HKEY_LOCAL_MACHINE\controlset001\services\sharedaccess\parameters\firewallpolicy
\standardprofile\authorizedapplications\list c:\windows\system32\opnsqr.exe

HKEY_LOCAL_MACHINE\controlset002\services\sharedaccess\parameters\firewallpolicy
\standardprofile\authorizedapplications\list c:\windows\system32\opnsqr.exe

HKEY_LOCAL_MACHINE\controlset003\services\sharedaccess\parameters\firewallpolicy
\standardprofile\authorizedapplications\list c:\windows\system32\opnsqr.exe

HKEY_LOCAL_MACHINE\currentcontrolset\services\sharedaccess\parameters\firewallpolicy
\standardprofile\authorizedapplications\list c:\windows\system32\opnsqr.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run relevantknowledge
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run relevantknowledge

NOTE: A real piece of fine spyware. RelevantKnowledge Any product that employs a user's Internet connection in the background without their knowledge, and gathers/transmits info on the user or their behavior.

back to the top

Last Reviewed:	1/14/2009
Keywords:	kbHow kbhowtoHow kbHOWTOHow #7473 kbAudITProHow

Contact