+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Infected] Password changed (/showthread.php?tid=4574929)
Pages: Pages
1
2
Password changed - TheDFighter - Dec 8, 2014
I'm making this thread for a friend, as his only solution to a potential virus is a reformat, and he refuses to go in this forum, because of them name... (he thinks he will get hacked)
So two days ago he was stupid enough to actually download a steam stealer, but luckily he got his items back, and formatted his pc.
The next day he received a facebook message from a stranger, telling him to go on a link. He followed the link, and realised that it was a scam, and closed the site without doing anything on it.
Today a lot of his passwords are changed.
What are the chances he is infected?
* - Lexica - Dec 8, 2014
Could be good depending on the site he visited, it could have been a JDB.
* - TheDFighter - Dec 8, 2014
Seems i'll have to do some cleanup then, could anyone guide me?
* - Aura - Dec 8, 2014
Can you PM me the link he clicked on, just to see if it was really infected with a JDB or other exploit ?
* - TheDFighter - Dec 8, 2014
I would be happy to do so, but i'm not allowed to send pm's atm :/
EDIT: it seems that it was a file, and not a link. He just thought it was a link, since it opened a fake browser window disguised as a fake facebook. The file has been deleted, so i can't report it sorry :/
* - Aura - Dec 8, 2014
(Dec 8, 2014 07:06 AM)TheDFighter Wrote: I would be happy to do so, but i'm not allowed to send pm's atm :/
EDIT: it seems that it was a file, and not a link. He just thought it was a link, since it opened a fake browser window disguised as a fake facebook. The file has been deleted, so i can't report it sorry :/
He opened the file right ?
Well, it's hard to tell you friend what to do and ask for real-time report if he doesn't sign up here.
* - TheDFighter - Dec 9, 2014
I decided to use Hyperions tutorial and the Tron script, that hyperion reviewed, on my friends pc, and he should be all clean now. It also seems he was using multiple antiviruses at once, because he thought more=better :x
* - Aura - Dec 9, 2014
(Dec 9, 2014 02:47 AM)TheDFighter Wrote: I decided to use Hyperions tutorial and the Tron script, that hyperion reviewed, on my friends pc, and he should be all clean now. It also seems he was using multiple antiviruses at once, because he thought more=better :x
Doesn't work that way.
Which Antivirus products does he have? I'll tell yoi which one he should keep.
* - TheDFighter - Dec 9, 2014
He had AVG, Norton and Kaspersky installed. Also some avast error popped up, from an unclean uninstall when we booted first time.
* - Aura - Dec 9, 2014
(Dec 9, 2014 06:42 AM)TheDFighter Wrote: He had AVG, Norton and Kaspersky installed. Also some avast error popped up, from an unclean uninstall when we booted first time.
If the Kaspersky licence is still active, uninstall AVG, Norton and avast! (If you don't see it installed, use its clean up tool). Start with that.
* - TheDFighter - Dec 9, 2014
Okay, i removed everything but kaspersky now. There's still a trial license active for kaspersky.
* - Aura - Dec 9, 2014
(Dec 9, 2014 06:57 AM)TheDFighter Wrote: Okay, i removed everything but kaspersky now. There's still a trial license active for kaspersky.
Alright. Do you still get the avast! error pop-up on boot or not ?
* - TheDFighter - Dec 9, 2014
No, i don't get the error message anymore
* - Aura - Dec 9, 2014
(Dec 9, 2014 07:01 AM)TheDFighter Wrote: No, i don't get the error message anymore
While we're at it, can you tell your friend to follow the instructions here:
[BHCPU] Program/Software advices and recommendations Help Desk by Aurа
And post the URL to the Pastebin/Privatepaste paste here or there?
* - TheDFighter - Dec 9, 2014
Yeah i Can do that. I Will have to wait till tommorow though, as it's 10:30 pm here atm