Hack Forums
Remove a JRAT? - SOLVED!!! - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: Remove a JRAT? - SOLVED!!! (/showthread.php?tid=4860804)

Pages: Pages 1 2 3 4 5

* - Avαlαr - Jun 12, 2015

(Jun 11, 2015 10:44 PM)Knautschtabak Wrote:  *snip

I'm not able to use my computer in normal mode. Will this work in Safe Mode?

Edit: It's working

* - Knautschtabak - Jun 12, 2015

Proceed with safe mode then.

* - Avαlαr - Jun 12, 2015

I wasn't able to use pastebin because of the file size limit, so I put the logs on File Dropper.

Farbar Recovery Scan Tool

FRST.txt: http://www.filedropper.com/frst

Addition.txt: http://www.filedropper.com/addition

RougeKiller

Report: http://www.filedropper.com/rkreportscn06122015095000

FINALLY something detected the rat on my computer! :D

* - Knautschtabak - Jun 12, 2015

RogueKiller Fix
  • Close any running programmes.

  • Right-Click RogueKiller.exe and select [Image: AVOiBNU.jpg] Run as administrator to run the programme.

  • Allow the Prescan to complete.

  • A browser window may open. Close the browser window.

  • Click [Image: jpgUwzp.png].

  • Upon completion, do the following:


  • Click [Image: 5UKuIKl.png] and place a checkmark next to all VT.Backdoor.Java.JRat items. Ensure any other items are unchecked.


  • Click [Image: QEIRkTE.png].


  • Click [Image: phPvmc6.png].

  • Copy the contents of the log and paste in your next reply.



Also check if you can access normal mode after that.

* - Immoral Collective - Jun 12, 2015

Just saying remove java for now and it will make the virus unable to run until you reinstall. Though it gives you time to send the .jar into virustotal and in about 4/5 days your av should be detecting it.

* - Avαlαr - Jun 12, 2015

(Jun 12, 2015 07:27 AM)Knautschtabak Wrote:  *snip

Awesome, I'll try that. :)

(Jun 12, 2015 07:34 AM)Immoral Collective Wrote:  Just saying remove java for now and it will make the virus unable to run until you reinstall. Though it gives you time to send the .jar into virustotal and in about 4/5 days your av should be detecting it.

I'll completely uninstall Java if/when I can, but I'm not sure when I should reinstall it.

When I first got this virus, it just slowed everything down a little bit. I could still do things on my computer, but typing was really slow, so I thought someone was logging my keystrokes. Also, my webcam came on once, and I changed all of my passwords since then. On a different computer of course.

When I was still able to use my PC in normal mode, I ran a scan by Kaspersky. It didn't find the rat, but for some reason the 30-day free trial for protecting my PC in real time worked, and everything was running like normal. Then I uninstalled and reinstalled Java with the antivirus still on, but a few hours later the virus came back and this time completely crippled my computer.

So how long should I wait before reinstalling Java again? And should I change my passwords a 3rd time?

Alright, here it is. http://www.filedropper.com/rkreportdel06122015114734

* - Knautschtabak - Jun 12, 2015

Can you access normal mode now?

* - Avαlαr - Jun 12, 2015

(Jun 12, 2015 08:52 AM)Knautschtabak Wrote:  Can you access normal mode now?

I'll try now.

btw, you had 1337 posts before that one just now. :D rip

Nope. :/ There's still pop-ups when I start up, and it's still really laggy.

Anything else I should try? I figured out that uTorrent worked in Safe Mode and I got a Windows 8.1 .iso. I was thinking of resetting my PC that way, since I don't have my own disc.

* - Knautschtabak - Jun 12, 2015

Reinstalling the operating system is always the safest option if infected with a backdoor/RAT.
It is up to you. Post a fresh FRST log (without Addition) if you want me to proceed with removal.

* - Avαlαr - Jun 12, 2015

(Jun 12, 2015 11:29 AM)Knautschtabak Wrote:  Reinstalling the operating system is always the safest option if infected with a backdoor/RAT.
It is up to you. Post a fresh FRST log (without Addition) if you want me to proceed with removal.

Yeah, I was prepared to reinstall my operating system, but I have a problem with that as well. When trying to reset Windows, it tells me that I need some missing information, like on a disc or USB. My computer came with Windows 8 pre-installed, so I didn't get a disc. I've updated to 8.1 since then.

I used a Third-Party program called NirSoft’s ProduKey to get the key for Windows 8.1. When my computer was still able to run normally, I tried entering in the key to reset my OS, because there was an option that would allow me to do that without needing a disc. However, the key didn't work.

I tried contacting Windows about it, to see if they would give me my correct key if the last one was wrong. But all wanted was my computer's Product ID so they could send me a Windows 8.1 disc for $119! Christ almighty.

* - Knautschtabak - Jun 12, 2015

Yes, that sucks. Do you still want to reformat? Or can I help you with anything else?

* - Avαlαr - Jun 12, 2015

(Jun 12, 2015 11:45 AM)Knautschtabak Wrote:  Yes, that sucks. Do you still want to reformat? Or can I help you with anything else?

Yes, please. If you can think of any way I can reformat my PC, that would be awesome. :)

* - Knautschtabak - Jun 12, 2015

Not sure if this is what you tried and were the key did not work, but take a look at this: http://www.bleepingcomputer.com/tutorials/how-to-perform-a-clean-install-of-windows-8/

* - Avαlαr - Jun 12, 2015

(Jun 12, 2015 11:54 AM)Knautschtabak Wrote:  Not sure if this is what you tried and were the key did not work, but take a look at this: http://www.bleepingcomputer.com/tutorials/how-to-perform-a-clean-install-of-windows-8/

Yeah. When I get to the part "Remove everything and reinstall Windows", I click Get Started, and this comes up:

"Insert media

Some files are missing. Your Windows installation or recovery media will provide these files."

Edit: And the part where I said that it would let me reinstall Windows without any recovery media only showed up in normal mode, which I can't access anymore. It asked for the Windows key and a USB drive with at least 3GB of space.

* - UnknownRaz - Jun 12, 2015

(Jun 12, 2015 11:54 AM)Knautschtabak Wrote:  senpai<3

BTW bro since i cannot pm i had to post here to remind u on my post