• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  


• Press Scan button.
  


• It will produce a log called FRST.txt in the same directory the tool is run from.
  


• Please copy and paste the log back here
  


• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
  

• Please download TDSSKiller and save the file to your Desktop.
  


• Right-Click TDSSKiller.exe and select Run as Administrator
  


• Click Change parameters. Place a checkmark next to Detect TDLFS file system and Verify file digital signatures.
  


• Click Start Scan. Do not use the computer during the scan.
  


• If objects are found, change the action to skip.
  


• Click Continue and close the window.
  


• A log will be created and saved to the root directory (usually C:\). Paste the file contents to pastebin.com and post the link in your next reply.
  

(Apr 26, 2016 03:19 PM)Annointed Wrote:  Get some logs so that people can see what's wrong. Here are the recommended programs from ProtectNull:

Download Farbar Recovery Scan Tool and save it to your Desktop.

Farbar Recovery Scanning Tool

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  


• Press Scan button.
  


• It will produce a log called FRST.txt in the same directory the tool is run from.
  


• Please copy and paste the log back here
  


• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
  

TDSSKiller

• Please download TDSSKiller and save the file to your Desktop.
  


• Right-Click TDSSKiller.exe and select Run as Administrator
  


• Click Change parameters. Place a checkmark next to Detect TDLFS file system and Verify file digital signatures.
  


• Click Start Scan. Do not use the computer during the scan.
  


• If objects are found, change the action to skip.
  


• Click Continue and close the window.
  


• A log will be created and saved to the root directory (usually C:\). Paste the file contents to pastebin.com and post the link in your next reply.
  

(Apr 26, 2016 04:47 PM)ProtectNull™ Wrote:  Yes, do this an I will assist you too. 🤝

(Apr 27, 2016 06:06 AM)Henning B Wrote:  YEAH, ill do that on my linux box.

I said I could give you journalctl logs: (warning huge)
http://paste.fedoraproject.org/360191/62367146/

(Apr 27, 2016 06:23 AM)ProtectNull™ Wrote:  Are you just using the normal Linux Distro or other distro such as Ubuntu, CentOS etc?

(Apr 27, 2016 06:27 AM)Henning B Wrote:  It is running arch linux.

• 1) sudo apt-get install chkrootkit
  


• 2) sudo chkrootkit
  


• 3) sudo chkrootkit -x | less
  

• 1) sudo apt-get install rkhunter
  


• 2) sudo rkhunter --check
  

(Apr 27, 2016 07:14 AM)ProtectNull™ Wrote:  Reserved, will assist soon.

---

Hello, I'm going to check if you have a rootkit

Please open terminal and type

• 1) sudo apt-get install chkrootkit
  


• 2) sudo chkrootkit
  


• 3) sudo chkrootkit -x | less
  

Please let me know if it finds any RK, if it does not.

Go back into terminal;

• 1) sudo apt-get install rkhunter
  


• 2) sudo rkhunter --check
  

And it it finds anything let me know.

(Apr 27, 2016 10:45 PM)Henning B Wrote:  Do you know Linux at all?

(Apr 27, 2016 10:46 PM)ProtectNull™ Wrote:  I use CentOS and Kali Linux and Ubuntu.

(Apr 27, 2016 11:23 PM)Henning B Wrote:  Aptitude is only for debian based distros, I'll run the program, but you can't run those commands on anything but debian.

(Apr 27, 2016 11:51 PM)ProtectNull™ Wrote:  So is your one yum install?

(Apr 28, 2016 01:33 AM)Henning B Wrote:  Arch: 'pacman -S firefox'

(Apr 28, 2016 07:52 AM)Henning B Wrote:  None of the tools found anything