Hi there. Today I wanted to talk about an adware named  TornPlusTV or TornPlusTV_version1.11 and thought I should give you some removal instructions. TornPlusTV_version1.11 appears to be a variant of CrossRider that I’ve blogged about before.

If TornPlusTV is installed on your system, you will find new the TornPlusTV add-ons installed in Firefox and Internet Explorer, TornPlusTV_version1.11-bg.exe running in the Windows Task Manager and many new scheduled tasks installed. The Chrome browser seems to stay unaffected. I’ll show how to remove TornPlusTV_version1.11 in this blog post with the FreeFixer removal tool.

Here’s the TornPlusTV add-on in Internet Explorer:

And the TornPlusTV_version1.11 add-on in Firefox:

You might also spot the TornPlusTV_version1.11-bg.exe in the Task Manager:

When I mess around with some new software I always upload it to VirusTotal to verify if the anti-malware progams there find something. Of the 55 scanners, 15 detected the file. The TornPlusTV_version1.11 files are detected as DLOADER.Trojan by DrWeb, W32/A-ee826839!Eldorado by F-Prot, Gen:Application.Heur.Ky9@ky9OVaii by F-Secure and Crossrider (fs) by VIPRE.

The files are digitally signed by Arod Group (BrightCircle Investments Limited): The certificated is quite new, it’s valid from the 17th of November 2014.

I’m sure you’d like to remove TornPlusTV_version1.11, and that’s pretty easy with FreeFixer. Select the TornPlusTV_version1.11 items, as shown in the screenshots below, click Fix, and reboot your machine and the problem should be gone.

The TornTVPlus process:

And the DLL loaded into Internet Explorer:

The scheduled tasks for TornPlusTV:

And last, the add-ons in Internet Explorer and Firefox:

Hope this helped you solved the TornPlusTV_version1.11 problem.

Do you also have TornPlusTV_version1.11 on your machine? Any idea how it installed? Please share your story the comments below. Thank you!

Thanks for reading!

Update 2014-11-26: Now the files are signed by Aussie Labs (BrightCircle Investments Limited):

Update 2014-12-04: Now the files are signed by “BadFinger Project (BrightCircle Investments Limited)”.

Update 2014-12-19: Files now signed by Armageddon Labs (BrightCircle Investments Limited).

Update 2015-01-15: The files are now digitally signed by Berta Dress Apps (Bright Circle Investments Ltd).

Update 2015-01-20: Now they are signed by Selecao Technologies (Bright Circle Investments Ltd).