+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Infected] Downloaded a virus/RAT (/showthread.php?tid=4924809)
Pages: Pages
1
2
Downloaded a virus/RAT - Snoopy - Jul 27, 2015
I'm pretty sure I've been infected with a virus, I've noticed random mouse movements, a command prompt (vbs.net?) running when I log in and also strange log-ins into my e-mail and PayPal (they even tried to buy something)
Scanned with MBAM multiple times but still nothing detected, can anyone please help
EDIT:
FRST: http://pastebin.com/f6YAX8Pc
Addition: http://pastebin.com/WHzeFHEz
* - kəˈrɪzmə - Jul 27, 2015
Download and run malware bytes
* - ze-slade - Jul 27, 2015
(Jul 27, 2015 03:40 PM)tahir. Wrote: I'm pretty sure I've been infected with a virus, I've noticed random mouse movements, a command prompt (vbs.net?) running when I log in and also strange log-ins into my e-mail and PayPal (they even tried to buy something)
Scanned with MBAM multiple times but still nothing detected, can anyone please help
You're definatley infected with a rat then.
* - 5chn4pp - Jul 27, 2015
(Jul 27, 2015 03:42 PM)Alpha Wolf Wrote: Download and run malware bytes
are you retarded? Read the thread.
* - ze-slade - Jul 27, 2015
(Jul 27, 2015 03:42 PM)Alpha Wolf Wrote: Download and run malware bytes
He already did that, read the op.
* - YungTrigz - Jul 27, 2015
(Jul 27, 2015 03:42 PM)Alpha Wolf Wrote: Download and run malware bytes
MBAM Means Malware Bytes, Don't make random suggestions.
* - Finestquad - Jul 27, 2015
Hit me up with your Teamviewer or Join.me i can help you:)
* - kəˈrɪzmə - Jul 27, 2015
Fuck me sorry I'm tired and shit.
Give me a break
* - YungTrigz - Jul 27, 2015
Download Farbar Recovery Scan Tool and save it to your Desktop.
- Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
- Press Scan button.
- It will produce a log called FRST.txt in the same directory the tool is run from.
- Please copy and paste the log back here
- The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
Please don't join that persons TV session or join.me.
* - Networx - Jul 27, 2015
PM your Skype. I can help you out.
* - Snoopy - Jul 27, 2015
(Jul 27, 2015 03:45 PM)YungTrigz Wrote: Download Farbar Recovery Scan Tool and save it to your Desktop.
- Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
- Press Scan button.
- It will produce a log called FRST.txt in the same directory the tool is run from.
- Please copy and paste the log back here
- The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
Please don't join that persons TV session or join.me.
FRST: http://pastebin.com/f6YAX8Pc
Addition: http://pastebin.com/WHzeFHEz
I wouldn't think of it but thank you
* - President Morty - Jul 28, 2015
Did you happen to add this to your startup?
C:\Users\Tahir\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.jar
C:\Users\Tahir\AppData\Roaming\1115448083.jar
Sketchy as fuck .jar
C:\Users\Tahir\AppData\Local\Temp\ose00000.exe
O_o I searched and found it as a windows process or something for a reader for like PDFs, I have no idea what that is.
Im just pointing out some odd files.
Dont do anything unless a trained malware specalist (2tired2care4spelling) comes by to review your logs.
* - Snoopy - Jul 28, 2015
(Jul 28, 2015 06:18 AM)L_USER Wrote: Did you happen to add this to your startup?
C:\Users\Tahir\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.jar
C:\Users\Tahir\AppData\Roaming\1115448083.jar
Sketchy as fuck .jar
C:\Users\Tahir\AppData\Local\Temp\ose00000.exe
O_o I searched and found it as a windows process or something for a reader for like PDFs, I have no idea what that is.
Im just pointing out some odd files.
Dont do anything unless a trained malware specalist (2tired2care4spelling) comes by to review your logs.
I'm only aware of the Client.jar and that's from myself, but the others I'm not sure. Thank you, I will wait.
* - YungTrigz - Jul 28, 2015
You seem to be infected, I have no training so I wouldn't try and make you a fixlist or something like that, What I do recommend is you PM Knaut Or Charmz With a link to your thread, if you do not receive help within 12 hours I will pm you a link somewhere you will get help quicker.
* - Snoopy - Jul 28, 2015
(Jul 28, 2015 07:58 AM)YungTrigz Wrote: You seem to be infected, I have no training so I wouldn't try and make you a fixlist or something like that, What I do recommend is you PM Knaut Or Charmz With a link to your thread, if you do not receive help within 12 hours I will pm you a link somewhere you will get help quicker.
Will do, thank you. I haven't noticed anything strange since last night after changing all my passwords and scanning my computer. I also didn't get the "vbs.net" command prompt when I signed in this time but I'll still wait for help just to be safe