Hi there. Today I wanted to talk about an adware named TornPlusTV or TornPlusTV_version1.11 and thought I should give you some removal instructions. TornPlusTV_version1.11 appears to be a variant of CrossRider that I’ve blogged about before.
If TornPlusTV is installed on your system, you will find new the TornPlusTV add-ons installed in Firefox and Internet Explorer, TornPlusTV_version1.11-bg.exe running in the Windows Task Manager and many new scheduled tasks installed. The Chrome browser seems to stay unaffected. I’ll show how to remove TornPlusTV_version1.11 in this blog post with the FreeFixer removal tool.
Here’s the TornPlusTV add-on in Internet Explorer:
And the TornPlusTV_version1.11 add-on in Firefox:
You might also spot the TornPlusTV_version1.11-bg.exe in the Task Manager:
When I mess around with some new software I always upload it to VirusTotal to verify if the anti-malware progams there find something. Of the 55 scanners, 15 detected the file. The TornPlusTV_version1.11 files are detected as DLOADER.Trojan by DrWeb, W32/A-ee826839!Eldorado by F-Prot, Gen:Application.Heur.Ky9@ky9OVaii by F-Secure and Crossrider (fs) by VIPRE.
The files are digitally signed by Arod Group (BrightCircle Investments Limited): The certificated is quite new, it’s valid from the 17th of November 2014.
I’m sure you’d like to remove TornPlusTV_version1.11, and that’s pretty easy with FreeFixer. Select the TornPlusTV_version1.11 items, as shown in the screenshots below, click Fix, and reboot your machine and the problem should be gone.
And the DLL loaded into Internet Explorer:
The scheduled tasks for TornPlusTV:
And last, the add-ons in Internet Explorer and Firefox:
Hope this helped you solved the TornPlusTV_version1.11 problem.
Do you also have TornPlusTV_version1.11 on your machine? Any idea how it installed? Please share your story the comments below. Thank you!
Thanks for reading!
Update 2014-11-26: Now the files are signed by Aussie Labs (BrightCircle Investments Limited):
Update 2014-12-04: Now the files are signed by “BadFinger Project (BrightCircle Investments Limited)”.
Update 2014-12-19: Files now signed by Armageddon Labs (BrightCircle Investments Limited).
Update 2015-01-15: The files are now digitally signed by Berta Dress Apps (Bright Circle Investments Ltd).
Update 2015-01-20: Now they are signed by Selecao Technologies (Bright Circle Investments Ltd).