I was hit with the hotoffers.info trojan a couple of days back. I tried all I could with Norton AV 2004 - there was no help. Infact there appears to be NO MENTION of this trojan on the SYmantec website. Crazy!!
I was then able to remove hotoffers.info trojan by following this thread -
http://www.daniweb.com/techtalkforums/thread16204.html
===quote crunchie=====
Got the little sucker . Can you go to C:\WINDOWS\System32\systr.dll and zip the systr.dll file up and email it to me at number1dad2000atyahoo.com.au (substitute at for @)
Download the Pocket KillBox
Unzip the file to your desktop.
Open TheKillbox.
Select the Delete on reboot option.
In the 'Full Path of File to Delete' box, copy and paste the following, clicking the 'Delete File' button (red circle with a white X) after pasting:
C:\WINDOWS\System32\systr.dll
When given the option to reboot select yes.
Once back in Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/a0002/
Let me know how you get on. Please post both logs from silentrunners and HJT.
__________________
====unquote=====
I downloaded HJT1.99, SIlentrunner.vbs, "Shoot the messenger" and "Pocket Killbox" and did what the thread asked to do.
Wonders - it all appears to have worked. No more of the filth and spam!!
Thank you crunchie.
Caution - For others hit by the trojan please follow the rules by first posting logs and then requesting help from the experts.
I was in a hurry and really took a chance.