Obsolete software key-Trolltech Keeps Coming Back

[twotix]

Hello,

 

Pardon if this is not really a bug but the following obsolete software key keeps popping up for deletion so I do it and it is back after every reboot. Thought to try this forum first to see if anyone else has experienced this issue on Win 7 Home Premium. After googling. it appears it is a defunct patform of some kind. Thx.

 

Obsolete software key    Trolltech    HKCU\Software\Trolltech

 

 

[hazelnut]

Just right click on the entry and select 'add to exclude list'.

[Nergal]

I have the troll tech one too (I've previously researched it and agreed it belonged to an application I use but don't remember which) so I excluded it (hazelnut's suggestion above). For the registry it's best to only remove what you know you don't need (see my signature below)

[twotix]

Okay, Thanks to Hazelnut and Nergal. Just wondered if it was some insidious malware or something since I can't link it to anything.

[twotix]

I have the troll tech one too (I've previously researched it and agreed it belonged to an application I use but don't remember which) so I excluded it (hazelnut's suggestion above). For the registry it's best to only remove what you know you don't need (see my signature below)

Posted this on bleeping computer and they say it is sophisticated malware... check out this thread.

 

http://www.bleepingcomputer.com/forums/t/535871/i-am-fighting-with-a-sophisticated-malware-for-weeks-help/

[hazelnut]

I see nothing in that thread that says it is sophisticated malware.

 

It has been around for years and on my XP machine (like nergal) I also have it, and am satisfied in my case that it belonged to an application so have excluded it.

[login123]

Over on Bleeping is another thread where member "yettibe" says it is a "sophisticated malware".  Not sure I believe that.

Here: 

http://www.bleepingcomputer.com/forums/t/535869/obsolete-software-key-trolltech-keeps-coming-back/

Fwiw, I have Trolltech and some related files on this xp box. 

They seem to be associated with VLC player, SMPlayer, and VLMC video editor.   

 

'Net searches show that it is usually associated with media apps, but there are some malware hits for it. 

I found some removal instructions that would almost certainly break my computer. 

Sooooo,

Afaik I have no infections (but not 100% sure lately) so I am going to leave it alone, like Nergal said. 

[twotix]

I see nothing in that thread that says it is sophisticated malware.

It is in the title of that posted thread, "I am fighting with a sophisticated malware for weeks! Help!". His post is from yesterday and in my thread he posted there the same thing stating " this is a sophisticated malware. sadly it is not so popular yet, so there is no public cleaner available. (as far as I know)

actually I just created a new thread about that persistent malware:

http://www.bleepingcomputer.com/forums/t/535871/i-am-fighting-with-a-sophisticated-malware-for-weeks-help/

 

Here is my thread..

http://www.bleepingcomputer.com/forums/t/535869/obsolete-software-key-trolltech-keeps-coming-back/

 

 

I'm running their scans so will post back here if anything comes of it.

[login123]

Welcome to the forum, belatedly. 

 

I have that registry entry, Nergal & Hazelnut also do, so probably that entry by itself does not mean malware. 

But from what I found using Googe & Duck Duck Go it might mean that. 

I would not conclude that it does unless one of the malware experts says so.  

 

Malware removal is fraught with dangers, as I'm sure you know, and even more dangerous is registry tinkering. 

That's why I posted that above. You are wise to let the experts handle it.   

 

Members here will benefit from what you find out.  Thanks. 

[hazelnut]

I am 100% certain that the entry I have is NOT malware.

 

However if you (twotix) are infected it is not because of the same key that I have and some others in this thread have, it will be because perhaps of being alongside something else on your machine.

 

You have already had to reset your windsock which points to it not being just a case of having trolltec as an obsolete software key.

 

Hope you get your problems sorted (by the way why did you tell them there were no replies to your post here?)

[eL_PuSHeR]

I have that entry too. And it's not malware. It's related to a legit (and free) program I use, using the QT framework.

[Andavari]

I think allot of people could freak out over just the name having "Troll" in it. Probably the same feelings would come if it was "VirusTech". 

[twotix]

I am 100% certain that the entry I have is NOT malware.

Okay, good. Thx.

 

However if you (twotix) are infected it is not because of the same key that I have and some others in this thread have, it will be because perhaps of being alongside something else on your machine.

Could be possible as my son got a new machine and I got his which was acting up. Had to replace the heat sync. I also get a weird pop up to a program nobody ever figured out although a bunch of scans were run from a troubleshooting site and it was pronounced clean.

 

You have already had to reset your windsock which points to it not being just a case of having trolltec as an obsolete software key.

When I did reset it my screen came up green on reboot so that did nothing. Had to do a system restore which only partially worked but I got a normal screen back.

 

Hope you get your problems sorted (by the way why did you tell them there were no replies to your post here?)

Because I posted here and went directly there and posted so y'all didn't have time to respond yet. No offense intended,

[twotix]

Responded in bold type...Thx.

 

Welcome to the forum, belatedly. 

Hey, Thanks!

 

I have that registry entry, Nergal & Hazelnut also do, so probably that entry by itself does not mean malware. 

But from what I found using Googe & Duck Duck Go it might mean that. 

I would not conclude that it does unless one of the malware experts says so.

I was trying to get an expert at bleepingcomputer.com. Funny I just ran ESET online scanner and look at all the Piriform programs that came up because of the google toolbar bundle.They had me check for " unwanted" programs. Not much faith in ESET.

C:\Program Files (x86)\CCleaner\ccsetup406.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application    deleted - quarantined
C:\Program Files (x86)\CCleaner\ccsetup407.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application    deleted - quarantined
C:\Program Files (x86)\CCleaner\ccsetup408.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application    deleted - quarantined
C:\Program Files (x86)\Defraggler\dfsetup215.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application    deleted - quarantined
C:\Program Files (x86)\Defraggler\dfsetup216.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application    deleted - quarantined

C:\Program Files (x86)\Speccy\spsetup123.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application    deleted - quarantined

C:\Users\MY\Downloads\CCleaner_v4.12.4657.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application    deleted - quarantined
C:\Users\MY\Downloads\ccsetup413.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application    deleted - quarantined
C:\Users\MY\Downloads\ccsetup414.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application    deleted - quarantined

 

Malware removal is fraught with dangers, as I'm sure you know, and even more dangerous is registry tinkering. 

True. I have learned the registry thing the hard way in the past.

That's why I posted that above. You are wise to let the experts handle it.   

Will do

Members here will benefit from what you find out.  Thanks.

Yw. Will share if I get any news

[twotix]

I have that entry too. And it's not malware. It's related to a legit (and free) program I use, using the QT framework.

Thanks for the info! Appreciate it.

[twotix]

I think allot of people could freak out over just the name having "Troll" in it. Probably the same feelings would come if it was "VirusTech". 

Probably. It seemed legit but just wondered why it kept coming back. Thx.

[twotix]

Update: This is a hand me down laptop from my son so the Global Mod from Bleepingcomputer.com said it probably has a trojan from cracked software. Urges a reinstall but it's a Sony Vaio and didn't come with recovery disks. Anyway, he said this about Trolltech:

 

Trolltech is not necessarily a malware. But it's file may have been infected. You were infected and probably from cracked software.
Every file there found by ESET is infected and should be removed. The cracks are free so they can give you infections like Themida .[

[login123]

Good that you have an expert helping. 

From the last couple of posts over at Bleeping it sounds like you have a big job ahead.

So it could be that yettibe was right.  

But I would stay with the instructions from the forum spyware expert. 

 

Now, then.  Ahem. Errrr, ummm.    

 

In post #8 at Bleeping, you said  "I posted trolltech first at the CCleaner forum and many are saying it isn't. Check it out."

That is not true.  It is an understandable miscommunication, but nevertheless it is not true. 

The folks here said exactly what the spyware mod over there said.  "Trolltech is not necessarily a malware."   But it might be. 

The folks here have said that their version of trolltech is not malware.  

 

I shall follow that thread over at Bleeping with interest, would be very interested to see how it goes. 

That is, if you woould be so kind as to post a link here when you start the removal topic. 

 

Hope you get it fixed.   Good hunting. 

[twotix]

 

Now, then.  Ahem. Errrr, ummm.    

 

In post #8 at Bleeping, you said  "I posted trolltech first at the CCleaner forum and many are saying it isn't. Check it out."

That is not true.  It is an understandable miscommunication, but nevertheless it is not true. 

 

Huge Roll Eyes….

I stand by what I said as being true and correct. First you state as if it is not malware or a big enough threat to attempt to remove it on your XP machine which isn’t even supported anymore. See Post 7. Then in post 9 you vascillate indicating it might be but your comment is convoluted and not succinct enough to make any determination. Hazelnut states it is “not malware”. eL_PuSHeR says it is “not malware”. Nergal agrees it belongs to an application thus is legit. Andavari doesn’t seem to think it is malware either. Looks like it is 4-1 as indifferent or positively not malware. You being the only possible person who thinks it might be. Hard to tell though because you waiver. I might add that Hazelnut was wrong with this comment:

Posted 29 May 2014 - 05:47 AM

I see nothing in that thread that says it is sophisticated malware.

It was in the title of the post as I responded to her.

 

Here is a more in depth analysis of the facts. Perhaps you should evaluate the facts before you make accusations.

 

-------------------------------------------------------------------

hazelnut stated (Posted 29 May 2014 - 12:32 AM) Just right click on the entry and select 'add to exclude list'.

We can conclude that ignoring this key by excluding it shows there is no

concern it is a malware threat.

 

 

Nergal posted this (Posted 29 May 2014 - 12:46 AM)

I have the troll tech one too (I've previously researched it and agreed it belonged to an application I use but don't remember which) so I excluded it (hazelnut's suggestion above). For the registry it's best to only remove what you know you don't need (see my signature below)

 

So it belongs to an application and was excluded then ignored so we can conclude that there was no effort to treat or remove it as malware.

 login123 posted this (Posted 29 May 2014 - 07:17 PM)

I have that registry entry, Nergal & Hazelnut also do, so probably that entry by itself does not mean malware.  But from what I found using Googe & Duck Duck Go it might mean that. I would not conclude that it does unless one of the malware experts says so.

So login123 thinks the entry is by itself “probably” does not mean malware. He then references searches stating it “might” mean that. (that the entry by itself probably does not mean malware). He won’t conclude that the entry by itself probably does not mean malware.

 

Hazelnut then states, “Posted 29 May 2014 - 11:37 PM

I am 100% certain that the entry I have is NOT malware.

eL_PuSHeR Posted Yesterday, 01:40 AM

I have that entry too. And it's not malware. It's related to a legit (and free) program I use, using the QT framework.

Andavari Posted Yesterday, 03:34 PM doesn’t seem to think it is malware either.

I think allot of people could freak out over just the name having "Troll" in it. Probably the same feelings would come if it was "VirusTech". 

Hazelnut was wrong with this comment:

Posted 29 May 2014 - 05:47 AM

I see nothing in that thread that says it is sophisticated malware.

It was in the title of the post as I responded to her.

 

[login123]

  OK, this'll be my last post for this topic, but I'll follow over on Bleeping if I can,  Hope you get it fixed. 

 

What the folks here have said is that the trolltech file on their computer is not malware. 

What the folks here have not said is that the trolltech file is never malware. 

 

The member yettibe over at Bleeping was the first to say that trolltech is sophisticated malware. 

Yettibe may be right about the file on your computer, but is wrong about the file on mine, Hazelnuts, etc. 

 

I would not change anything about my computer except on the advice of a recognized malware expert like boopme. 

Not based on an uncorroberated statement by a new and unknown forum member.  (Yettibe, 3 posts)

Although that may be a big disservice to yettibe, if so I apologize. 

 

The only involvement CCleaner had was to help you identify a problem, so I won't use any more of this forums pixel quota. 

 

If you would prefer a quarrel to an agreeable discourse, thats ok by me, but I have quit this topic. 

[mta]

maybe an opportune point to close the thread since it has reached the 'I think, You think' stage and before it descends further.

plus it seems to be handled well over at bleeping computer.

[hazelnut]

This thread is now closed.

 

We wish you well in riding your computer of malware.