BleepingComputer.com: Trojan Hiloti

Jump to content

Forum Guidelines

Posted Image Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help


Posted Image Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.


Posted Image DO NOT RUN ComboFix unless requested to.


Posted Image Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.


Posted Image When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.


Posted Image Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  • 2 Pages +
  • 1
  • 2
  • You cannot start a new topic
  • This topic is locked

Trojan Hiloti AVG 8.0 Free and MalwareBytes unsuccessful

#16 User is offline   B-boy/StyLe/ 

  • Bleeping Freestyler
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Team
  • Posts: 2,760
  • Joined: 28-September 09
  • Gender:Male
  • Location:Bulgaria

Posted 05 April 2011 - 07:56 PM

Hi Rob,



Great work.
I have some final words for you...


All Clean :thumbsup:


Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it Clean :)



Cleanup


To remove all of the tools we used and the files and folders they created, please do the following:


Please reopen Posted Image on your desktop.

In the upper right click CleanUp

Posted Image

This will delete OTL and will clean up after it.


Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

A little hint for you - go ahead and delete the following tools/files => DDS, GMER, ERUNT, tdsskiller, Defogger, rkill etc. if they still exist after the procedure above.


You can also uninstall - ESET Online Scanner, Erunt and Wirelss WEP Password Spy as well.



Clean the java cache


To Clear the Java Runtime Environment (JRE) cache, do this:
  • Click Start > Settings > Control Panel.
  • Double-click the Java icon.
    -The Java Control Panel appears.
  • Click "Settings" under Temporary Internet Files.
    -The Temporary Files Settings dialog box appears.
  • Click "Delete Files".
    -The Delete Temporary Files dialog box appears.
    -There are three options on this window to clear the cache.
    • Delete Files
    • View Applications
    • View Applets

  • Click "OK" on Delete Temporary Files window.
    -Note: This deletes all the Downloaded Applications and Applets from the cache.
  • Click "OK" on Temporary Files Settings window.
  • Close the Java Control Panel.
You can also view these instructions along with screenshots here.



Re-enable your antivirus software


  • Please go ahead and turn on AVG Resident Shield protection.
  • Make sure that you keep your antivirus updated.
  • New viruses come out every minute, so it is essential that you have the latest signatures for your antivirus program to provide you with the best possible protection from
    malicious software.
    Note:
  • You should only have one antivirus installed at a time. Having more than one antivirus program installed at once is likely to cause conflicts and may well decrease your
    overall protection as well as impairing the performance of your PC.




Visit Microsoft's Windows Update Site Frequently


It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security

updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no

more critical updates.



Practice Safe Internet


One of the main reasons people get infected in the first place is that they are not practicing Safe Internet. You practice Safe Internet when you educate yourself on how to

properly use the Internet through the use of security tools and good practice. Knowing how you can get infected and what types of files and sites to avoid will be the most

crucial step in keeping your computer malware free. The reality is that the majority of people who are infected with malware are ones who click on things they shouldn't be

clicking on. Whether these things are files or sites it doesn't really matter. If something is out to get you, and you click on it, it most likely will. Below are a list

of simple precautions to take to keep your computer clean and running securely:

  • If you receive an attachment from someone you do not know, DO NOT OPEN IT! Simple as that. Opening attachments from people you do not know is a very common method

    for viruses or worms to infect your computer.


  • If you receive an attachment and it ends with a .exe, .com, .bat, or .pif do not open the attachment unless you know for a fact that it

    is clean. For the casual computer user, you will almost never receive a valid attachment of this type.


  • If you receive an attachment from someone you know, and it looks suspicious, then it probably is. The email could be from someone you know infected with a malware that

    is trying to infect everyone in their address book.


  • If you are browsing the Internet and a popup appears saying that you are infected, ignore it!. These are, as far as I am concerned, scams that are being used to

    scare you into purchasing a piece of software. For an example of these types of popups, or Foistware, you should read this article:

    Foistware, And how to avoid it.

    There are also programs that disguise themselves as Anti-Spyware or security products but are instead scams. For a list of these types of programs we recommend you visit

    this link: Rogue/Suspect Anti-Spyware Products & Web Sites


  • Another tactic to fool you on the web is when a site displays a popup that looks like a normal Windows message or alert. When you click on them, though, they instead

    bring you to another site that is trying to push a product on you. We suggest that you close these windows by clicking on the X instead of the OK button.

    Alternatively, you can check to see if it's a real alert by right-clicking on the window. If there is a menu that comes up saying Add to Favorites... you know it's a

    fake.


  • Do not go to adult sites. I know this may bother some of you, but the fact is that a large amount of malware is pushed through these types of sites. I am not saying all

    adult sites do this, but a lot do.


  • When using an Instant Messaging program be cautious about clicking on links people send to you. It is not uncommon for infections to send a message to everyone in the

    infected person's contact list that contains a link to an infection. Instead when you receive a message that contains a link, message back to the person asking if it is

    legit before you click on it.


  • Stay away from Warez and Crack sites! In addition to the obvious copyright issues, the downloads from these sites are typically overrun with infections.


  • Be careful of what you download off of web sites and Peer-2-Peer networks. Some sites disguise malware as legitimate software to trick you into installing them and

    Peer-2-Peer networks are crawling with it. If you want to download a piece of software a from a site, and are not sure if they are legitimate, you can use

    McAfee Siteadvisor to look up info on the site.


  • DO NOT INSTALL any software without first reading the End User License Agreement, otherwise known as the EULA. A tactic that some developers use is to offer their

    software for free, but have spyware and other programs you do not want bundled with it. This is where they make their money. By reading the agreement there is a good chance

    you can spot this and not install the software.




Install an AntiSpyware Program


An effective scanner that you already have is Malwarebytes Anti-Malware.

Other highly recommended AntiSpyware program is SuperAntiSpyware. You can download the free Home

Version or the Pro version for a 15 day trial period.

Installing these programs will provide spyware & hijacker protection on your computer alongside your virus protection. You should scan your computer with an AntiSpyware

program on a regular basis just as you would an antivirus software. Be sure to check for and download any definition updates prior to performing a scan.



Don't use pirated software !!!


Avoid using cracks and unknown programs from sources you don't trust. There are MANY alternative open-source applications.

Malware writers just love cracks and keygens, and will often attach malicious code into them. By using cracks and/or keygens, you are asking for problems.

So my advice is - stay away from them!



Create an image of your system


It is always a good idea to do a backup of all important files just in case something happens it.

Macrium Reflect is very good choice that enables you to create an image of your system drive which can be restored in case of problems.

The download link is here => http://www.macrium.com/reflectfree.asp

The tutorials can be found here => http://www.macrium.com/tutorial.asp

Be sure to read the tutorial first. :thumbup2:



Follow this list and your potential for being infected again will reduce dramatically.



Safe Surfing ! :wink:



Regards,
Georgi
Posted Image

I'll be unavailable for the next 2 days. (26 and 27 may).
I will reply at Monday (28 may). Sorry for the inconvenience!

#17 User is offline   Cheesehead 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 10
  • Joined: 04-April 11

Posted 06 April 2011 - 10:09 AM

Hi Georgi,

I kept refreshing the forum page we were posting to looking for a reply from you and kept coming up with my post as being the last one made...I didn't notice for quite some time that there was actually a page two started and that was where your reply was located. Sorry for the delay in my reply.

Thank you so much for all of your help and I certainly will be more vigilant in more efforts.

Again...all of your efforts are greatly appreciated!

Warm regards,

Rob

#18 User is offline   B-boy/StyLe/ 

  • Bleeping Freestyler
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Team
  • Posts: 2,760
  • Joined: 28-September 09
  • Gender:Male
  • Location:Bulgaria

Posted 06 April 2011 - 10:38 AM

Hi Cheesehead,



You are more then welcome ! :)

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.



Regards,
Georgi
Posted Image

I'll be unavailable for the next 2 days. (26 and 27 may).
I will reply at Monday (28 may). Sorry for the inconvenience!

Share this topic:


  • 2 Pages +
  • 1
  • 2
  • You cannot start a new topic
  • This topic is locked

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users