Infected by a trojan - Printable Version

Infected by a trojan - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: Infected by a trojan (/showthread.php?tid=5920211)

Infected by a trojan - CocaColax - Dec 18, 2018

I removed this trojan more than 200 times but every time that I reset the machine it's come back.
Any Idea?
[Image: hxH55WW.png]

RE: Infected by a trojan - Leroy Jethro Gibbs - Dec 18, 2018

What are you using to remove it?

My suggestion if you haven't tried already would be HitmanPro. You can use the onetime use trial and get it removed.

If that doesn't get the job done, then I believe you might need to hunt down in regedit and your files the location of the files triggering your AV.

https://www.hitmanpro.com/en-us.aspx

Also based on the name it would appear to be a browser hijacker that might actually have a mining aspect to it. I would attempt to clean with hitman pro then clear that browsers data all together. Should be fine if you use an account sync'd to it. I would also highly recommend changing that password.

RE: Infected by a trojan - 5chn4pp - Dec 18, 2018

Brocoiner is usually a very easy malware to delete, if your anti-malware has deleted it many times and it keeps coming back, then there would probably be more malware that keeps dropping that file.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Right click to run as administrator. When the tool opens click Yes to disclaimer.

Press Scan button.

It will produce logs called FRST.txt and Addition.txt in the same directory the tool is run from.

Please copy and paste the logs back here.

RE: Infected by a trojan - root@HF - Dec 18, 2018

(Dec 18, 2018 02:10 AM)Skyl1ne Wrote: I removed this trojan more than 200 times but every time that I reset the machine it's come back.
Any Idea?

Have you actually seen the location where it's stored and removed the source executable?
I played around with powershells the other day and I keep having a trojan pop up.
But it's set to be in the C:\autorun.inf file.

[Image: 7ZZj5vq.png]

Now my computer is back to normal.
Maybe try to locate the source file and erase it from your computer.