Hack Forums
[Check-Up] Might be infected, downloaded some stuff from a malicious fake website - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Check-Up] Might be infected, downloaded some stuff from a malicious fake website (/showthread.php?tid=5084430)

Might be infected, downloaded some stuff from a malicious fake website - Brian Williams - Dec 6, 2015

Just went to a super malicious website, ended up downloading 2 things from there. Deleted the downloads however I'm still paranoid. Please check up on me, willing to do something in return if you do! I also haven't had a scan for a either, so I might as well check.

FRST - http://pastebin.com/kc5fN7TK
Addition - http://pastebin.com/s6SbEGRz

Please try and check thoroughly and carefully, if you help I'll be willing to do any favors, I'm not trying to mooch off of you guys.

* - 5chn4pp - Dec 6, 2015

[Image: lv0mVRW.png] Junkware Removal Tool
  • Please download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts.

  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".

  • The tool will open and start scanning your system.

  • Please be patient as this can take a while to complete depending on your system's specifications.

  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

  • Post the contents of JRT.txt into your next message.




* - Brian Williams - Dec 6, 2015

(Dec 6, 2015 05:19 PM)Polymorphic Plague Wrote:  [Image: lv0mVRW.png] Junkware Removal Tool
  • Please download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts.

  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".

  • The tool will open and start scanning your system.

  • Please be patient as this can take a while to complete depending on your system's specifications.

  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

  • Post the contents of JRT.txt into your next message.



Thanks, here it is!

Quote:~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.1 (11.24.2015)
Operating System: Windows 10 Home x64
Ran by Pontiflex (Administrator) on Sun 12/06/2015 at 19:21:57.08
~




File System: 5

Successfully deleted: C:\Users\Pontiflex\AppData\Local\ysearchutil (Folder)
Successfully deleted: C:\Windows\system32\Tasks\update-S-1-5-21-3149210877-3634557585-4153862484-1001 (Task)
Successfully deleted: C:\Windows\system32\Tasks\update-sys (Task)
Successfully deleted: C:\Windows\Tasks\update-S-1-5-21-3149210877-3634557585-4153862484-1001.job (Task)
Successfully deleted: C:\Windows\Tasks\update-sys.job (Task)



Registry: 1

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{804F7057-A140-491D-AC42-44E29B78C53E} (Registry Key)




~
Scan was completed on Sun 12/06/2015 at 19:23:27.93
End of JRT log
~



* - 5chn4pp - Dec 6, 2015

Please post fresh FRST.txt and Addition.txt logs.

* - Brian Williams - Dec 6, 2015

(Dec 6, 2015 05:28 PM)Polymorphic Plague Wrote:  Please post fresh FRST.txt and Addition.txt logs.

You want me to scan my system again and post those logs?

* - 5chn4pp - Dec 6, 2015

(Dec 6, 2015 05:32 PM)Brian Williams Wrote:  You want me to scan my system again and post those logs?

yes