McAfee > Theat Center > PUP Detail Page

Characteristics

McAfee(R) AVERT™ recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application.  If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Distribution

The adware can be bundled with various applications(Older Versions) or it can be installed on its own as well (Newer versions). The newer version of Adware-TVMedia drops additional files like TVM.exe, TVMbho.dll and TVMcore.dll. It installs the DLL files as Browser Helper objects in Internet Explorer. These DLLs are responsible for showing anonymous ads via popups.
The main installer of TVMedia does not show any EULA or privacy notice, however a privacy notice can be shown if it is bundled with some other application. The generated ads prompt the user to download various utility softwares like regclean.exe etc.

The uninstaller supports manual removal i.e. the user is asked to enter a key displayed on the screen, if user enters correct key the application is successfully removed.

Installation

The application registers the DLL file as Browser Helper Object to Internet Explorer

Keys Added

• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2}\InprocServer32\: "C:\Program Files\TV Media\TvmBho.dll"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks\{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2}:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Run\TV Media: "C:\Program Files\TV Media\Tvm.exe"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
  CurrentVersion\Uninstall\TV Media\UninstallString: "C:\Program Files\TV Media\Tvm.exe /u"

Files Added

• C:\Program Files\TV Media\Tvm.exe (95,744 bytes)
  MD5: E5 F9 4A 9E A3 49 7F 94 86 5A 0A 63 7C D1 47 6A
• C:\Program Files\TV Media\TvmBho.dll (88,576 bytes )
  MD5: 08 F2 60 4D 64 FF 13 00 8E 15 6B FF F3 EC D2 5C
• C:\Program Files\TV Media\TvmCore.dll (237,568 bytes)
  MD5: AB FD 8F 2A 50 7A 63 D7 49 56 82 5B 33 6E 01 BF

Note: The Information below describes the behaviour of TVMedia in Older versions of the program, where it was seen to be bundled with a program named MemoryMeter.

In the case of MemoryMeter, a clickable end-user license agreement is displayed, which describes what the adware does. It reads as follows:

Furthermore, by installing the Software on your computer, you understand that: (i) certain system non-personally identifiable information, including statistical data, stored on your computer will be made available and transmittable to Total Velocity servers or the servers of affiliated companies of Total Velocity; (ii) other information available now or in the future including links, services, messages advertisements, cookies and the like may be installed on your computer and; (iii) Total Velocity may automatically transmit to and install on your computer, Software improvements, corrections, adaptations, conversions to more recent Software versions or any other changes to the Software, with or without giving notice.

The following system changes were observed when running this application (NOTE : Other filenames are likely to occur in the future [some have already been seen, MSMGT.EXE and TINYINSTALLER.EXE]):

Added files
• c:\Program Files\MemoryMeter\MemoryMeter.exe
• c:\WINNT\TVMD.exe

Added registry keys
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Run "MemoryMeter" = C:\Program Files\MemoryMeter\MemoryMeter.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Run "TVMD" = C:\WINNT\TVMD.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Uninstall\MemoryMeter "DisplayName" = Memory Meter
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Uninstall\MemoryMeter "InstallLocation" = \Program Files\MemoryMeter
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Uninstall\MemoryMeter "UninstallString" = C:\Program Files\MemoryMeter\MemoryMeter.exe -uninstall
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Uninstall\TVMD "DisplayName" = TV Media Display
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Uninstall\TVMD "UninstallString" = C:\WINNT\TVMD.exe -uninstall

To remove this application one must uninstall both the TV Media and MemoryMeter applications via the ADD/REMOVE Programs Control Panel.

Removal

Instructions on Enabling/Disabling Detection and Removal of Potentially Unwanted Programs

Aliases

Aliases

• Adware-TVelocity
• BackDoor-AYT
• Uploader-F