Re: tmksrvu.exe

From: ZGlobus (zglobus_at_hotmail.com)
Date: 01/13/04


Date: 13 Jan 2004 04:43:25 -0800

yosponge@yahoo.com (sponge) wrote in message news:<8d76ec03.0401120925.55150ca6@posting.google.com>...
> "Chris" <sat_ring@hotmail.com> wrote in message news:<bts3a6$afc7d$1@ID-54577.news.uni-berlin.de>...
> > I have removed tmksrvu.exe
> > run avg wiht new update trendmicro on line as well
> > but it still resetting my home page to =
> > http://81.211.105.9/index.php?v=3
> >
> > What now ?
> >
> > Regards
> > Chris
>
> I suspect this is a CoolWebSearch trojan variant, one of many. New
> ones emerge just about every week. Run the "Big Four" - first,
> download and run CWShredder, then SpyBot S&D, Ad-Aware, and
> SpywareBlaster. CWShredder should nail this one, but the other three
> are necessary for other stuff. If all else fails, you can run
> HiJackThis! and post the results here. I suggest submitting this to
> the maker of CWShredder, SpyBot, and Ad-Aware if you can.
>
> Sponge
> Sponge's Secure Solutions
> www.geocities.com/yosponge
> My new email: yosponge2 att yahoo dott com

Sponge, You are absolutely right. This is a CoolWebSearch trojan variant.
It can be fixed by the latest version of CWShredder (v1.44.2).
http://www.spywareinfo.com/~merijn/files/CWShredder.exe

ZGlobus