• Ensure you read through my instructions thoroughly, and carry out each step in the order specified.
  


• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in providing the best set of instructions for you.
  


• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable at times.
  


• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
  


• I will notify you when I believe your computer is free of malware. Please bear in mind, absence of symptoms does not necessarily correlate to absence of malware, so please wait until the "All Clean".
  

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
  


• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
  


• Right-Click FRST.exe or FRST64.exe and select Run as Administrator
  


• Click Yes to the disclaimer.
  


• Ensure the Addition.txt box is checked.
  


• Click the Scan button and let the program run.
  


• Upon completion, click OK, then OK on the Addition.txt pop up screen.
  


• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.
  

• Download RogueKiller (32 bit)/RogueKiller (64 bit) and save the file to your Desktop.
  


• Note: Download and run the version compatible with your system (32 or 64-bit). Download the first (32-bit) if you're unsure.
  


• Close any running programs.
  


• Right-Click RogueKiller.exe and select Run as administrator to run the program.
  


• Allow the Prescan to complete. Upon completion, a window will open. Click Accept.
  


• A browser window may open. Close the browser window.
  


• Click . Upon completion, click .
  


• Close the program. Do not fix anything!
  


• A log (RKreport.txt) will be open. Copy the contents of the log to pastebin.com, click Submit and paste the link to it in your next reply.
  

(May 20, 2015 03:17 AM)Dafuq. Wrote:  My posts are getting deleted!!!!

(May 20, 2015 03:14 AM)Autocorrect Wrote:  Wow that's quite weird, considering the last time he updated the thread (with a new link presumably?) was in March.

(May 20, 2015 03:18 AM)Meow. Wrote:  stfu already,your posts are here

(May 20, 2015 03:17 AM)Knautschtabak Wrote:  If you can, get on another computer and disconnect the infected one from the network.

------
Backdoor warning: We can remove the visible infection signs, but due to the nature of this type of malware, no one can guarantee the trustworthiness of your computer. If you want to use it for anything important like online-banking, reformat and install of your operating system is the safest option.

Note: Please change any of your passwords from a non-infected computer.
------

Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Ensure you read through my instructions thoroughly, and carry out each step in the order specified.
  


• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in providing the best set of instructions for you.
  


• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable at times.
  


• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
  


• I will notify you when I believe your computer is free of malware. Please bear in mind, absence of symptoms does not necessarily correlate to absence of malware, so please wait until the "All Clean".
  

------
Step 1: Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
  


• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
  


• Right-Click FRST.exe or FRST64.exe and select Run as Administrator
  


• Click Yes to the disclaimer.
  


• Ensure the Addition.txt box is checked.
  


• Click the Scan button and let the program run.
  


• Upon completion, click OK, then OK on the Addition.txt pop up screen.
  


• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.
  

Step 2: RogueKiller

• Download RogueKiller (32 bit)/RogueKiller (64 bit) and save the file to your Desktop.
  


• Note: Download and run the version compatible with your system (32 or 64-bit). Download the first (32-bit) if you're unsure.
  


• Close any running programs.
  


• Right-Click RogueKiller.exe and select Run as administrator to run the program.
  


• Allow the Prescan to complete. Upon completion, a window will open. Click Accept.
  


• A browser window may open. Close the browser window.
  


• Click . Upon completion, click .
  


• Close the program. Do not fix anything!
  


• A log (RKreport.txt) will be open. Copy the contents of the log to pastebin.com, click Submit and paste the link to it in your next reply.
  

(May 20, 2015 06:56 AM)mrfong Wrote:  @op i think i'm facing the same problem, njrat isnt running and roguekiller detected it and all my passwords are hacked my gmail is hacked, same goes for my paypal ,all happend 2 hours ago! wtf
Edit: I'm not sure if it's the same problem but i'm just thinking that it might be the same

(May 20, 2015 06:59 AM)Asterea Wrote:  I can confirm this software is backdoored by xVulnerable.
Did my analysis, network communication, file drops and startup can confirm it.

(May 20, 2015 06:57 AM)Dafuq. Wrote:  I guess there is some issue with njRAT!

(May 20, 2015 07:18 AM)mrfong Wrote:  I think so , also , i lost 360 slave on njrat , when i get one they dissaper, and i downloaded njrat and roguekiller recently so it might be njrat or something old, not sure though