+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [TuT] How to remove Rats,Malware, Adware etc. [NOOB FRIENDLY] (/showthread.php?tid=3952255)
[TuT] How to remove Rats,Malware, Adware etc. [NOOB FRIENDLY] - Mqnster - Dec 25, 2013
As i have been seing that alot of people are having trouble of removing rats, malwares, adwares (etc) i thought i would help out a bit, by following these easy steps.
- [*] To remove the specifique problem, headover to to this link and download the file called "Hijackthis.exe".
Spoiler (Click to View)
[*] Once downloaded right click the .exe file and click on "Run as admin". Now go ahead and click on: "Do a system scan and save the logfiles."
Spoiler (Click to View)
[*] It should now do a system scan, and open a logfile.
Spoiler (Click to View)
Keep the logfile open and COPY + PASTE everything inside the notepad, into the this "box".
Spoiler (Click to View)
[*] It should now begin to analyze it, and it will tell if there is any file(s) corrupted / infected.
Spoiler (Click to View) As seen on mine, there is some Spoiler (Click to View) Which indicates that the file is not infected nore corrupted, but that it's not a file / progam which was original created by windows 7(Xp,Vista,Windows 8), such as League of legends.
[*] Now if you did find some Spoiler (Click to View) You wanna go find the corrupted file with the "X", and there it should say where / which folder it's located in.
Spoiler (Click to View)
As seen with with mine, its inside the C:/Program Files (x86)/Gyazo Folder. (THIS IS NOT A VIRUS, THIS IS FOR EDUCATION ONLY. I DO NOT CLAIM THAT GYAZO IS INFECTED / CORRUPTED)
So now where we know where the corrupted / Infected file is located at, go a head and maximise the hijackthis.exe window.
Spoiler (Click to View)
And scroll around, until you find the exact folder/name as said in on the website, and check the little box in the right corner, and then press "Fix Checked".
Spoiler (Click to View)
![[Image: 9cc9da8fa8d4db46351f9b3e4c0b2a01.png]](https://gyazo.com/9cc9da8fa8d4db46351f9b3e4c0b2a01.png)
![[Image: da1c00f80cafc83bb687941d9a5ced3a.png]](https://gyazo.com/da1c00f80cafc83bb687941d9a5ced3a.png)
![[Image: b92d86d0bed84c243ed377bf03b8b9b0.gif]](https://gyazo.com/b92d86d0bed84c243ed377bf03b8b9b0.gif)
![[Image: 28b24b60d73a5902292ccaa7be34bf38.png]](https://gyazo.com/28b24b60d73a5902292ccaa7be34bf38.png)
![[Image: 4ef7acba8f7982cd61d03c29b5f0c670.png]](https://gyazo.com/4ef7acba8f7982cd61d03c29b5f0c670.png)
![[Image: 2ddc0011c987cd2ec361ed37c18241ec.gif]](https://gyazo.com/2ddc0011c987cd2ec361ed37c18241ec.gif)
![[Image: 49fde10de3ad6bfb80ef198c790e53cc.png]](https://gyazo.com/49fde10de3ad6bfb80ef198c790e53cc.png)
"![[Image: ec59f70afe979f24338b5bd2fec0fd52.png]](https://gyazo.com/ec59f70afe979f24338b5bd2fec0fd52.png)
"(S)![[Image: caaec5fcfdc942d3562e001e3563e5d9.png]](https://gyazo.com/caaec5fcfdc942d3562e001e3563e5d9.png)
![[Image: 0420a76012227acced48b2237e6545c4.png]](https://gyazo.com/0420a76012227acced48b2237e6545c4.png)
![[Image: ab335634670d1ba1e63895acd4af1ead.gif]](https://gyazo.com/ab335634670d1ba1e63895acd4af1ead.gif)
SUCCES! THE CORRUPTED / INFECTED FILE SHOULD NOW BEEN DELETED / FIXED. 🎉🎉
Feedback is appreciated. I know my grammar aint the best and that the thread has a lousy design, but this is one of my first TuTs.
Thanks!
//Mqnster
* - Gionizer - Dec 25, 2013
Nice tutorial!! 😉😁
And as you already said, your grammer isn't the best, so I'm not going to be picky about it 🙃
And again, thanks for this man 😎
- Gionizer 🤝
* - Mqnster - Dec 25, 2013
(Dec 25, 2013 07:41 PM)Gionizer Wrote: Nice tutorial!! 😉😁
And as you already said, your grammer isn't the best, so I'm not going to be picky about it 🙃
And again, thanks for this man 😎
- Gionizer 🤝
Np. Thank you for your feedback, appreciated mutch.
* - bulby13 - Dec 25, 2013
Although this method may solve your problem, the HiJackThis analyzer may not get 0day or new threats. Also, HiJackThis/OTL is not for the home user, it's for analysis by malware helpers.
I think you're better off using tools like Malwarebytes and AdwCleaner, as you may delete unwanted registry keys and programs by false positives (Scanners have FPs, but not as much).
Although this method works a decent amount of times, I still recommend scanners.
* - Aura - Dec 25, 2013
Nice tutorial, but as stated above, HijackThis shouldn't be used by standard users that have no idea on how to read the logs and analyze them. Also, HijackThis isn't meant for 64-bits operating system, leaving this tutorial a bit useless as most people here runs 64-bits versions of Windows.
* - Mqnster - Dec 26, 2013
(Dec 25, 2013 09:40 PM)Aurа Wrote: Nice tutorial, but as stated above, HijackThis shouldn't be used by standard users that have no idea on how to read the logs and analyze them. Also, HijackThis isn't meant for 64-bits operating system, leaving this tutorial a bit useless as most people here runs 64-bits versions of Windows.
Well my operative system is running with 64bit, and everything is working as intended
(Dec 25, 2013 09:40 PM)Aurа Wrote: Nice tutorial, but as stated above, HijackThis shouldn't be used by standard users that have no idea on how to read the logs and analyze them. Also, HijackThis isn't meant for 64-bits operating system, leaving this tutorial a bit useless as most people here runs 64-bits versions of Windows.
My operative system runs with 64bit, and everything is working as intended
* - executionerhf - Dec 26, 2013
Thanks for the tutorial man. I'll definitely try this.
* - En1gma - Dec 26, 2013
Nice tutorial, this should help out a few people. You could add to it that if people can't read logs they should send it to an MRT member.
* - Ombra - Dec 26, 2013
Nice tut to hjt usage :) 'll be useful for other members.
* - Aura - Dec 26, 2013
(Dec 26, 2013 05:27 AM)Mqnster Wrote: Well my operative system is running with 64bit, and everything is working as intended
My operative system runs with 64bit, and everything is working as intended
But if HijackThis hit 64-bits items, it will not modify it as its not made to be used on 64-bits systems. So it will only modify 32-bits items.
* - Gustav. - Dec 26, 2013
HijackThis is incredibly old & outdated on many levels. Even the simplest form of AdWare can bypass their scans- I wouldn't recommend on using it for furture security reasons.