JS. SEEKER ?

This trojan alters the default startup and search pages for your web browser. The Windows Scripting Host must be installed for the trojan to run. It is believed that a script generating program may be involved in the creation of this trojan, which allows the author to specify different parameters. The trojan may arrive as a file named \"runme.hta\". Opening this file makes several registry changes to your system, such as:
HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Default_Page_URL
HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Default_Search_URL
HKCU\\Software\\Netscape\\Netscape Navigator\\Main\\Home Page

Original registry values are saved to the files \"HOMEREG111.REG\", \"BACKUP1.REG\", and \"BACKUP2.REG\" in the WINDOWS directory.

Symptoms 
- Altered startup and search pages when launching web browser
- Presence of \"runme.hta\", \"removeit.hta\", or \"homereg111.reg\" 

Du kan altid gå ind på http://vil.nai.com/vil/
for at se info om div. vira