From: ZGlobus (zglobus_at_hotmail.com)
Date: 13 Jan 2004 04:43:25 -0800
firstname.lastname@example.org (sponge) wrote in message news:<email@example.com>...
> "Chris" <firstname.lastname@example.org> wrote in message news:<bts3a6$afc7d$1@ID-54577.news.uni-berlin.de>...
> > I have removed tmksrvu.exe
> > run avg wiht new update trendmicro on line as well
> > but it still resetting my home page to =
> > http://126.96.36.199/index.php?v=3
> > What now ?
> > Regards
> > Chris
> I suspect this is a CoolWebSearch trojan variant, one of many. New
> ones emerge just about every week. Run the "Big Four" - first,
> download and run CWShredder, then SpyBot S&D, Ad-Aware, and
> SpywareBlaster. CWShredder should nail this one, but the other three
> are necessary for other stuff. If all else fails, you can run
> HiJackThis! and post the results here. I suggest submitting this to
> the maker of CWShredder, SpyBot, and Ad-Aware if you can.
> Sponge's Secure Solutions
> My new email: yosponge2 att yahoo dott com
Sponge, You are absolutely right. This is a CoolWebSearch trojan variant.
It can be fixed by the latest version of CWShredder (v1.44.2).