What is TornTV?
The Malwarebytes research team has determined that TornTV is adware. These adware applications display advertisements not originating from the sites you are browsing.
How do I know if my computer is affected by TornTV?
You may see this entry in your list of installed programs:
and this warning during install:
How did TornTV get on my computer?
Adware applications use different methods for distributing themselves. This particular one was offered as video download software.
How do I remove TornTV?
Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.
- Please download Malwarebytes Anti-Malware to your desktop.
- Double-click mbam-setup-version.exe and follow the prompts to install the program.
- At the end, be sure a check-mark is placed next to the following:
- Enable free trial of Malwarebytes Anti-Malware Premium
- Launch Malwarebytes Anti-Malware
- Then click Finish.
- If an update is found, you will be prompted to download and install the latest version.
- Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
- When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
- Reboot your computer if prompted.
- No, Malwarebytes' Anti-Malware removes TornTV completely.
We hope our application and this guide have helped you eradicate this hijacker.
As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the TornTV adware. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.
Technical details for experts
There are no visible signs in a HijackThis log
You may see these signs in FRST logs:
CHR HKLM-x32\...\Chrome\Extension: [jbpkiefagocgkmemidfngdkamloieekf] - C:\Program Files (x86)\TornTV.com\torn11.crx () C:\Program Files (x86)\TornTV.com () C:\Users\{username}\Desktop\TornTV.lnk () C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com TornTV (HKLM-x32\...\1ClickDownload) (Version: 2.1 Build 26473 - TornTV.com) <==== ATTENTIONAlterations made by the installer:
File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Program Files (x86)\TornTV.com Adds the file uninst.exe"="25-May-15 8:05 PM, 89278 bytes, A Adds the file torn11.crx Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com Adds the file TornTV.lnk"="25-May-15 8:05 PM, 846 bytes, A Adds the file Uninstall.lnk"="25-May-15 8:06 PM, 1080 bytes, A In the existing folder C:\Users\{username}\Desktop Adds the file TornTV.lnk"="25-May-15 8:05 PM, 810 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}\instl\data] "hrdId"="REG_SZ", "11111111" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data] "aflt"="REG_SZ", "11111111" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf] "path"="REG_SZ", "C:\Program Files (x86)\TornTV.com\torn11.crx" "version"="REG_SZ", "1.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Iminent] "AppInstanceUid"="REG_SZ", "11111111" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload] "DisplayName"="REG_SZ", "TornTV" "DisplayVersion"="REG_SZ", "2.1 Build 26473" "Publisher"="REG_SZ", "TornTV.com" "UninstallString"="REG_SZ", "C:\Program Files (x86)\TornTV.com\uninst.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SweetIM] "simapp_id"="REG_SZ", "11111111" [HKCU\Software\1ClickDownload] "LastInstall0"="REG_SZ", "30447381" "LastInstall2"="REG_SZ", "30447381" "LastInstall3"="REG_SZ", "30447381" "UID"="REG_SZ", "131217580" [HKCU\Software\Microsoft\Windows\CurrentVersion\UFH\SHC] "0"="REG_MULTI_SZ, "C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com\TornTV.lnk C:\Program Files (x86)\TornTV.com\TornTV.exe " [HKCU\Software\SweetIM] "simapp_id"="REG_SZ", "11111111"Malwarebytes Anti-Malware log:
Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 25-May-15 Scan Time: 8:13:47 PM Logfile: mbamTornTV.txt Administrator: Yes Version: 2.01.6.1022 Malware Database: v2015.05.25.05 Rootkit Database: v2015.05.24.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 8.1 CPU: x64 File System: NTFS User: {username} Scan Type: Threat Scan Result: Completed Objects Scanned: 343261 Time Elapsed: 26 min, 43 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 6 PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\Iminent, Quarantined, [59807423acde81b5a0eb94991de7e020], PUP.Optional.SweetIM.A, HKLM\SOFTWARE\WOW6432NODE\SweetIM, Quarantined, [a1383364abdfcd69d38132bf20e3847c], PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\jbpkiefagocgkmemidfngdkamloieekf, Quarantined, [c1182a6d434767cfecc79478be467c84], PUP.Optional.1ClickDownload.A, HKCU\SOFTWARE\1ClickDownload, Quarantined, [35a47324c8c2ac8a169ae1629174916f], PUP.Optional.SweetIM.A, HKCU\SOFTWARE\SweetIM, Quarantined, [776281165f2bcc6a68eb3eb39f6445bb], PUP.Optional.TornTV.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\1ClickDownload, Quarantined, [d900efa88bff68ce18e7bcf415ee33cd], Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 2 PUP.Optional.TornTV.A, C:\Program Files (x86)\TornTV.com, Quarantined, [d900efa88bff68ce18e7bcf415ee33cd], PUP.Optional.TornTV.A, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com, Quarantined, [11c8098ea8e2270fac83f9cf4fb4f30d], Files: 4 PUP.Adware.Agent, C:\Users\{username}\Desktop\installerCM.exe, Quarantined, [b0291285ddad1323d57b68868779c43c], PUP.Optional.TornTV.A, C:\Program Files (x86)\TornTV.com\uninst.exe, Quarantined, [d900efa88bff68ce18e7bcf415ee33cd], PUP.Optional.TornTV.A, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com\TornTV.lnk, Quarantined, [11c8098ea8e2270fac83f9cf4fb4f30d], PUP.Optional.TornTV.A, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com\Uninstall.lnk, Quarantined, [11c8098ea8e2270fac83f9cf4fb4f30d], Physical Sectors: 0 (No malicious items detected) (end)As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention