Removal instructions for TornTV

[Metallica]

What is TornTV?

The Malwarebytes research team has determined that TornTV is adware. These adware applications display advertisements not originating from the sites you are browsing.

How do I know if my computer is affected by TornTV?

You may see this entry in your list of installed programs:



and this warning during install:



How did TornTV get on my computer?

Adware applications use different methods for distributing themselves. This particular one was offered as video download software.

How do I remove TornTV?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.

• Please download Malwarebytes Anti-Malware to your desktop.
• Double-click mbam-setup-version.exe and follow the prompts to install the program.
• At the end, be sure a check-mark is placed next to the following:
  • Enable free trial of Malwarebytes Anti-Malware Premium
  • Launch Malwarebytes Anti-Malware
• Then click Finish.
• If an update is found, you will be prompted to download and install the latest version.
• Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
• When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
• Reboot your computer if prompted.

Is there anything else I need to do to get rid of TornTV?

• No, Malwarebytes' Anti-Malware removes TornTV completely.

How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the TornTV adware. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.

 

Technical details for experts

There are no visible signs in a HijackThis log

You may see these signs in FRST logs:
 

 CHR HKLM-x32\...\Chrome\Extension: [jbpkiefagocgkmemidfngdkamloieekf] - C:\Program Files (x86)\TornTV.com\torn11.crx [Not Found]
 () C:\Program Files (x86)\TornTV.com
 () C:\Users\{username}\Desktop\TornTV.lnk
 () C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com

TornTV (HKLM-x32\...\1ClickDownload) (Version: 2.1 Build 26473 - TornTV.com) <==== ATTENTION

Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\TornTV.com
       Adds the file uninst.exe"="25-May-15 8:05 PM, 89278 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com
       Adds the file TornTV.lnk"="25-May-15 8:05 PM, 846 bytes, A
       Adds the file Uninstall.lnk"="25-May-15 8:06 PM, 1080 bytes, A
    In the existing folder C:\Users\{username}\Desktop
       Adds the file TornTV.lnk"="25-May-15 8:05 PM, 810 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}\instl\data]
       "hrdId"="REG_SZ", "11111111"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data]
       "aflt"="REG_SZ", "11111111"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf]
       "path"="REG_SZ", "C:\Program Files (x86)\TornTV.com\torn11.crx"
       "version"="REG_SZ", "1.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Iminent]
       "AppInstanceUid"="REG_SZ", "11111111"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload]
       "DisplayName"="REG_SZ", "TornTV"
       "DisplayVersion"="REG_SZ", "2.1 Build 26473"
       "Publisher"="REG_SZ", "TornTV.com"
       "UninstallString"="REG_SZ", "C:\Program Files (x86)\TornTV.com\uninst.exe"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SweetIM]
       "simapp_id"="REG_SZ", "11111111"
    [HKCU\Software\1ClickDownload]
       "LastInstall0"="REG_SZ", "30447381"
       "LastInstall2"="REG_SZ", "30447381"
       "LastInstall3"="REG_SZ", "30447381"
       "UID"="REG_SZ", "131217580"
    [HKCU\Software\Microsoft\Windows\CurrentVersion\UFH\SHC]
       "0"="REG_MULTI_SZ, "C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com\TornTV.lnk C:\Program Files (x86)\TornTV.com\TornTV.exe  "
    [HKCU\Software\SweetIM]
       "simapp_id"="REG_SZ", "11111111"

Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 25-May-15
Scan Time: 8:13:47 PM
Logfile: mbamTornTV.txt
Administrator: Yes

Version: 2.01.6.1022
Malware Database: v2015.05.25.05
Rootkit Database: v2015.05.24.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: {username}

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 343261
Time Elapsed: 26 min, 43 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 6
PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\Iminent, Quarantined, [59807423acde81b5a0eb94991de7e020], 
PUP.Optional.SweetIM.A, HKLM\SOFTWARE\WOW6432NODE\SweetIM, Quarantined, [a1383364abdfcd69d38132bf20e3847c], 
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\jbpkiefagocgkmemidfngdkamloieekf, Quarantined, [c1182a6d434767cfecc79478be467c84], 
PUP.Optional.1ClickDownload.A, HKCU\SOFTWARE\1ClickDownload, Quarantined, [35a47324c8c2ac8a169ae1629174916f], 
PUP.Optional.SweetIM.A, HKCU\SOFTWARE\SweetIM, Quarantined, [776281165f2bcc6a68eb3eb39f6445bb], 
PUP.Optional.TornTV.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\1ClickDownload, Quarantined, [d900efa88bff68ce18e7bcf415ee33cd], 

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 2
PUP.Optional.TornTV.A, C:\Program Files (x86)\TornTV.com, Quarantined, [d900efa88bff68ce18e7bcf415ee33cd], 
PUP.Optional.TornTV.A, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com, Quarantined, [11c8098ea8e2270fac83f9cf4fb4f30d], 

Files: 4
PUP.Adware.Agent, C:\Users\{username}\Desktop\installerCM.exe, Quarantined, [b0291285ddad1323d57b68868779c43c], 
PUP.Optional.TornTV.A, C:\Program Files (x86)\TornTV.com\uninst.exe, Quarantined, [d900efa88bff68ce18e7bcf415ee33cd], 
PUP.Optional.TornTV.A, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com\TornTV.lnk, Quarantined, [11c8098ea8e2270fac83f9cf4fb4f30d], 
PUP.Optional.TornTV.A, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com\Uninstall.lnk, Quarantined, [11c8098ea8e2270fac83f9cf4fb4f30d], 

Physical Sectors: 0
(No malicious items detected)


(end)

As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):

• Dynamically Blocks Malware Sites & Servers
• Malware Execution Prevention

Save yourself the hassle and get protected.

Edited July 8, 2016 by Metallica