Hack Forums
How can I check if I'm being ratted? - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: How can I check if I'm being ratted? (/showthread.php?tid=5259172)



How can I check if I'm being ratted? - colja123 - May 4, 2016

For a bunch of hours now, my passwords from youtube accounts always change... I'm not changing them... I don't even get the warning that they got changed - an email! How can I find out? I tried looking for something in CMD, but there were no signs... Anything I can do?


* - Lana Del Rey - May 4, 2016

lol what did you look at in CMD?

Check your registry, startup, processes and or just do a full format and change your passwords also at a 2factor authorization feature to any accounts.


* - colja123 - May 4, 2016

(May 4, 2016 11:01 AM)Lana Del Rey Wrote:  lol what did you look at in CMD?

Check your registry, startup, processes and or just do a full format and change your passwords also at a 2factor authorization feature to any accounts.

Netstate -ano
Dir /a-d/b


* - Knautschtabak - May 4, 2016

Hello colja123

Please read through the points below before we start.
  • Read my instructions thoroughly, and carry out each step in the specified order.

  • Do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in providing the best set of instructions for you.

  • Please backup important files before proceeding with my instructions. Malware removal can be unpredictable at times.

  • If you come across any issues, please stop and inform me of the issue in detail. Do not hesitate to ask before proceeding.

  • I will notify you when I believe your computer is free of malware. The absence of symptoms does not necessarily mean that your computer is clean.

  • If I do not reply within 48 hours, write a PM. I might have just overlooked your thread. Keep in mind that we likely live in different time zones.

  • I might abandon your thread if you do not reply within five days. I take only as many logs as I can handle.


------

Step 1: Farbar Recovery Scan Tool (FRST) Scan
  • Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.

  • Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.

  • Right-Click FRST.exe or FRST64.exe and select Run as Administrator

  • Click Yes to the disclaimer.

  • Ensure the Addition.txt box is checked.

  • Click the Scan button and let the program run.

  • Upon completion, click OK, then OK on the Addition.txt pop up screen.

  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.


Step 2: aswMBR
  • Please download aswMBR and save the file to your Desktop.

  • Temporarily disable your anti-virus software. For instructions, please refer to the following link.

  • Right-Click aswMBR.exe and select Run as administrator to run the program.

  • Click Yes when prompted to download avast! virus definitions. Wait until AVAST engine defs: ### appears.

  • If you are prompted to enable the use of "Virtualization Technology", click Yes.

  • Click the AV Scan: drop down box and click C:\.

  • Click Scan.

  • Upon completion, you will see Scan finished successfully. Click Save log. Save the log to your Desktop.

  • Re-enable your anti-virus software.

  • Copy the contents of the log to pastebin.com and paste the link in your next reply.


Note: Do NOT click Fix or FixMBR.
Note: A file (MBR.dat) will be created on your Desktop. Do NOT click or delete it.