Hack Forums
Fresh Windows installation infected? - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: Fresh Windows installation infected? (/showthread.php?tid=5523384)

Fresh Windows installation infected? - ChickenChickenow - Jan 14, 2017

Hey
Just installed Win 10 Anniversary on my laptop, was a pain to move Users folder to HDD instead of SSD so I'd rather not reinstall it...
I wanted to try ''HitmanPro Alert'' so I downloaded it (not from official website) but didn't like it so I uninstalled it..Then I downloaded BitTorrent Pro and Malwarebytes Premium, did a scan and it looks all clear except I was getting malicious IP notificaitions from ''8528.exe'' I stopped it in task manager and deleted it.. It's no longer here for now but I'm still paranoid.
Can somebody help out? I really don't want to reinstall windows again

Thanks in advance

* - Hackoo - Jan 14, 2017

Farbar Recovery Scan Tool (FRST) Scan
  • Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.

  • Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.

  • Double-Click FRST.exe or FRST64.exe to run the programme

  • Click Yes to the disclaimer.

  • Ensure the Addition.txt box is checked.

  • Click the Scan button and let the program run.

  • Upon completion, click OK, then OK on the Addition.txt pop up screen.

  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.



In your next reply I get from you
  • FRST.txt

  • Addition.txt




* - ChickenChickenow - Jan 14, 2017

(Jan 14, 2017 11:19 AM)Hackoo Wrote:  Farbar Recovery Scan Tool (FRST) Scan
  • Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.

  • Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.

  • Double-Click FRST.exe or FRST64.exe to run the programme

  • Click Yes to the disclaimer.

  • Ensure the Addition.txt box is checked.

  • Click the Scan button and let the program run.

  • Upon completion, click OK, then OK on the Addition.txt pop up screen.

  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.



In your next reply I get from you
  • FRST.txt

  • Addition.txt



Here:
http://pastebin.com/WdCqtUxX
http://pastebin.com/VjeUMZK8
On reboot I saw the file is back in appdata/local/Iddnsoft/
it's trying to access winsrw.com

* - Hackoo - Jan 14, 2017

(Jan 14, 2017 11:33 AM)ChickenChickenow Wrote:  Here:
http://pastebin.com/WdCqtUxX
http://pastebin.com/VjeUMZK8
On reboot I saw the file is back in appdata/local/Iddnsoft/
it's trying to access winsrw.com
I can't see any report ???
This page has been removed !

* - a7383532 - Jan 14, 2017

If you torrented the iso for it than it could be infected by the uploader

* - ChickenChickenow - Jan 15, 2017

Got a BSOD and windows didn't boot anymore so I had to reinstall it.. Sorry for wasting your time and thanks anyway