tmksrvu.exe

I have removed tmksrvu.exe
run avg wiht new update trendmicro on line as well
but it still resetting my home page to =
http://81.211.105.9/index.php?v=3

What now ?

Regards
Chris

Chris

"Chris" <> wrote in message news:<bts3a6$afc7d$>...
> I have removed tmksrvu.exe
> run avg wiht new update trendmicro on line as well
> but it still resetting my home page to =
> http://81.211.105.9/index.php?v=3
>
> What now ?
>
> Regards
> Chris

I suspect this is a CoolWebSearch trojan variant, one of many. New
ones emerge just about every week. Run the "Big Four" - first,
download and run CWShredder, then SpyBot S&D, Ad-Aware, and
SpywareBlaster. CWShredder should nail this one, but the other three
are necessary for other stuff. If all else fails, you can run
HiJackThis! and post the results here. I suggest submitting this to
the maker of CWShredder, SpyBot, and Ad-Aware if you can.

Sponge
Sponge's Secure Solutions
www.geocities.com/yosponge
My new email: yosponge2 att yahoo dott com

sponge

(sponge) wrote in message news:<. com>...
> "Chris" <> wrote in message news:<bts3a6$afc7d$>...
> > I have removed tmksrvu.exe
> > run avg wiht new update trendmicro on line as well
> > but it still resetting my home page to =
> > http://81.211.105.9/index.php?v=3
> >
> > What now ?
> >
> > Regards
> > Chris
>
> I suspect this is a CoolWebSearch trojan variant, one of many. New
> ones emerge just about every week. Run the "Big Four" - first,
> download and run CWShredder, then SpyBot S&D, Ad-Aware, and
> SpywareBlaster. CWShredder should nail this one, but the other three
> are necessary for other stuff. If all else fails, you can run
> HiJackThis! and post the results here. I suggest submitting this to
> the maker of CWShredder, SpyBot, and Ad-Aware if you can.
>
> Sponge
> Sponge's Secure Solutions
> www.geocities.com/yosponge
> My new email: yosponge2 att yahoo dott com

Sponge, You are absolutely right. This is a CoolWebSearch trojan variant.
It can be fixed by the latest version of CWShredder (v1.44.2).
http://www.spywareinfo.com/~merijn/files/CWShredder.exe

ZGlobus

ZGlobus

"Chris" <> wrote in message
news:bts3a6$afc7d$...
>
Thanks
,
It was this bugger "XPlugin" that kept it in play.

Regards
Chris

Chris