![]() |
|
[Infected] Infected by a friend - Printable Version +- Hack Forums (https://hackforums.net) +-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45) +--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448) +---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110) +---- Thread: [Infected] Infected by a friend (/showthread.php?tid=4538387) |
Infected by a friend - Gokus_Dog - Nov 15, 2014 Results of screen317's Security Check version 0.99.89 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 11 ``````Antivirus/Firewall Check:`````` Windows Security Center service is not running! This report may not be accurate! Windows Firewall Enabled! WMI entry may not exist for antivirus; attempting automatic update. ``````Anti-malware/Other Utilities Check:`````` Java 8 Update 25 Java version out of Date! Adobe Flash Player 15.0.0.223 Adobe Reader XI Mozilla Firefox 31.0 Firefox out of Date! Google Chrome 38.0.2125.104 Google Chrome 38.0.2125.111 ``````Process Check: objlist.exe by Laurent`````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Malwarebytes Anti-Malware mbamscheduler.exe ``````System Health check`````` Total Fragmentation on Drive C: ``````End of Log`````` http://privatepaste.com/74cb5d9ac5 - FRST http://privatepaste.com/583915a092 - Additions http://privatepaste.com/f5906d2140 -MBAM Scan from when I was infected The background of what happened is that a friend send me a link which auto downloaded a file, I didn't run it but it did save in my downloads folder. * - ven0m - Nov 15, 2014 Delineate your current issue regarding your system. * - Gokus_Dog - Nov 16, 2014 (Nov 15, 2014 10:51 PM)ven0m Wrote: Delineate your current issue regarding your system. So my friend send me a link of which to look at. After I clicked it the file automatically downloaded, suspecting it was a virus I didn't open it but MBAM picked it up as a trojan so I decided to come here. * - ven0m - Nov 16, 2014 Greetings from the Hackforum's Malware Removal Team! You will be provided assistance by myself upon agreeing to my terms which are listed below for your viewing pleasure. Feel free to inform myself with any issues you have regarding my terms and I will discontinue my assistance. Continuing with the steps provided below will be considered as compliance to my terms.
You, hereby, consign myself the right to withdraw my assistance upon a violation of a single term.
Regards, ven0m * - Gokus_Dog - Nov 17, 2014 ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok esets_scanner_update returned -1 esets_gle=12 # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7623 # api_version=3.0.2 # EOSSerial=2264d752b085ea4abde5f56db84c82e1 # engine=21134 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2014-11-18 12:22:36 # local_time=2014-11-17 07:22:36 (-0500, Eastern Standard Time) # country="United States" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # scanned=568597 # found=0 # cleaned=0 # scan_time=9445 http://privatepaste.com/4a3118de8a - FRST http://privatepaste.com/983705a63e - Additions * - ven0m - Nov 17, 2014
Regards, ven0m * - Gokus_Dog - Nov 18, 2014 Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-11-2014 Ran by Administrator at 2014-11-18 20:45:10 Run:2 Running from C:\Users\Administrator\Desktop\FRST-OlderVersion Loaded Profile: Administrator (Available profiles: Administrator) Boot Mode: Normal ====== Content of fixlist: **** Start Emptytemp: Closeprocesses: HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <====== ATTENTION CHR StartupUrls: Default -> "", "hxxp://www.msn.com/?pc=UP97&ocid=UP97DHP", "hxxp://rocket-find.com/?f=7&a=rckt_md_14_28_ch&cd=2XzuyEtN2Y1L1QzuyC0C0FtDyEzytDyEzy0F0DtByCzytD0CtN0D0Tzu0SzytBtDtN1L2Xzut?BtFtBtCtFtCyEtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyB0FzytA0E0E0D0Dt?GyCtDtDyEtGtB0DtBtAtG0B0EtCyDtGyDzztD0B0AtCzztA0C0FyE0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2?SyCtC0A0AtA0B0FtBtGyDyD0BtCtG0EzztByCtGtDtAyB0DtGtAyCtAtA0EtC0CzyyDtAyByC2Q&cr=877554481&ir=" End **** Processes closed successfully. "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. Chrome StartupUrls deleted successfully. EmptyTemp: => Removed 665.4 MB temporary data. The system needed a reboot. ==== End of Fixlog ==== * - ven0m - Nov 18, 2014 Hi, I see no infection present in your system at the moment and I am declaring you All Clean.
* - Gokus_Dog - Nov 19, 2014 # DelFix v10.8 - Logfile created 19/11/2014 at 18:42:15 # Updated 29/07/2014 by Xplode # Username : Administrator - IK-PC # Operating System : Windows 7 Ultimate Service Pack 1 (64 bits) ~ Activating UAC ... OK ~ Removing disinfection tools ... Deleted : C:\_OTL Deleted : C:\FRST Deleted : C:\AdwCleaner Deleted : C:\Users\Administrator\Downloads\FRST-OlderVersion Deleted : C:\Users\Administrator\Desktop\FRST-OlderVersion Deleted : C:\TDSSKiller.2.8.16.0_06.10.2013_14.26.11_log.txt Deleted : C:\TDSSKiller.2.8.16.0_06.10.2013_14.26.58_log.txt Deleted : C:\Users\Administrator\Desktop\FRST64.exe Deleted : C:\Users\Administrator\Desktop\scan.txt Deleted : C:\Users\Administrator\Downloads\Addition.txt Deleted : C:\Users\Administrator\Downloads\AdwCleaner.exe Deleted : C:\Users\Administrator\Downloads\esetsmartinstaller_enu (1).exe Deleted : C:\Users\Administrator\Downloads\esetsmartinstaller_enu (2).exe Deleted : C:\Users\Administrator\Downloads\esetsmartinstaller_enu.exe Deleted : C:\Users\Administrator\Downloads\FRST.txt Deleted : C:\Users\Administrator\Downloads\FRST64.exe Deleted : C:\Users\Administrator\Downloads\JRT (1).exe Deleted : C:\Users\Administrator\Downloads\JRT.exe Deleted : C:\Users\Administrator\Downloads\SecurityCheck (1).exe Deleted : C:\Users\Administrator\Downloads\SecurityCheck.exe Deleted : C:\Users\Administrator\Downloads\Shortcut.txt Deleted : HKLM\SOFTWARE\OldTimer Tools Deleted : HKLM\SOFTWARE\AdwCleaner Deleted : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMBR ~ Creating registry backup ... OK ~ Cleaning system restore ... Deleted : RP #1979 [Windows Update | 11/17/2014 03:00:10] Deleted : RP #1981 [Windows Update | 11/17/2014 20:25:57] Deleted : RP #1982 [Windows Update | 11/18/2014 01:28:15] Deleted : RP #1983 [Windows Update | 11/19/2014 01:53:32] Deleted : RP #1984 [Windows Update | 11/19/2014 22:11:28] New restore point created ! ~ Resetting system settings ... OK ###### - EOF - ###### * - ven0m - Nov 19, 2014 Safe surfing. Since the issue is resolved, a staff will close this topic as solved. If you are are the topic starter and think otherwise, Private Message (PM) a staff to re-open this topic. Everyone else requiring assistance are asked to create their own thread. Glad we could help... :Smile: |