Hack Forums
[Infected] Weird Virus (virus.neshta) [STILL NEED HELP!!!] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Infected] Weird Virus (virus.neshta) [STILL NEED HELP!!!] (/showthread.php?tid=5617328)

Weird Virus (virus.neshta) [STILL NEED HELP!!!] - Xogg - May 7, 2017

So i got this virus and its doing a few things, one when I try to open for example: Notepad++ its prompting saying to run in svchost.com. If i click yes sometimes it will open and other times it will open the wizard which asks me to chose what to run it in. This has resulted to me not being able to open 95% of the things on my pc. Here are a few

-Google Chrome
-Internet Explorer
-Mozila Firefox
-Explorer.exe
-CMD

I have bypassed this for some programs by for example opening: Explorer.exe in Explorer.exe so opening the program that wont open in itself, (If that makes any since)

My pc is currently on and in safe mode with networking, this allowed me to open and use google chrome. But still is prompting with svchost.com

I used malwareBytes to do a FULL scan yesterday and here is the main detection I kept getting.
[Image: .eJwFwdsNwyAMAMBdGADzsAtkG0QQiZpgBI76UXX...height=219]
The "Type" is virus.neshta


If you cant read the image here is a direct link
Spoiler (Click to View)

Also in the image it gives a directory in where the virus is, I DID delete the whole directory of where it was all occurring.


EDIT: So i did scans using RKILL64 and ADWcleaner but i was in safe mode on my PC I restarted my PC and redid them and got differnt results logs soon!


LOGS


ADWcleaner
Spoiler (Click to View)

RKILL64
Spoiler (Click to View)


Farbar Recovery Scan Tool
Spoiler (Click to View)

* - Rexethic - May 7, 2017

Seems like adware, with bunch of popups and injected into svhost.
Try MalwareBytes Anti-Malware.

* - Xogg - May 7, 2017

(May 7, 2017 09:52 AM)Rexethic Wrote:  Seems like adware, with bunch of popups and injected into svhost.
Try MalwareBytes Anti-Malware.

Is this the same as the regular MalwareBytes or a different program, I already scanned in malwareBytes

* - DelziumTheProudWhale_temp - May 7, 2017

scan your pc with eset antivirus

* - KyFu - May 7, 2017

Use Adwcleaner by Malwarebytes. [FREE]
Panda Cloud Cleaner is also a very good program to use. [Takes awhile on full scan, but accurate.] [FREE]

* - Xogg - May 7, 2017

(May 7, 2017 10:03 AM)KyFu-Engineering Wrote:  Use Adwcleaner by Malwarebytes. [FREE]
Panda Cloud Cleaner is also a very good program to use. [Takes awhile on full scan, but accurate.] [FREE]

I will give these both a go.

* - 5chn4pp - May 7, 2017

Only FRST can remove viruses such as this, virus.neshta is like a ramnit infection, its severe and no antimalware tool expect for FRST and similar will remove it.

EDIT: It's also known as "Predator logger" which is a RAT, so please change your passwords.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Right click to run as administrator. When the tool opens click Yes to disclaimer.

  • Press Scan button.

  • It will produce logs called FRST.txt and Addition.txt in the same directory the tool is run from.

  • Please copy and paste the logs back here.




* - Xogg - May 7, 2017

(May 7, 2017 10:32 AM)Satudarah Wrote:  Only FRST can remove viruses such as this, virus.neshta is like a ramnit infection, its severe and no antimalware tool expect for FRST and similar will remove it.

EDIT: It's also known as "Predator logger" which is a RAT, so please change your passwords.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Right click to run as administrator. When the tool opens click Yes to disclaimer.

  • Press Scan button.

  • It will produce logs called FRST.txt and Addition.txt in the same directory the tool is run from.

  • Please copy and paste the logs back here.



Thanks for the help working on c=scanning now.

* - Mr. Kim - May 7, 2017

If it's still happening in safemode you have a bad situation friend. The malware is running from kernel space. The malware has the same integrity as the OS itself. I would use a rescue disk.

One from Kaspersky

One from Comodo

One from Avast

I can promise you it will not be removed if you boot to your current OS. If it looks like it's gone, it's just hiding.

* - 5chn4pp - May 7, 2017

(May 7, 2017 05:17 PM)Mҽmѳry Wrote:  I can promise you it will not be removed if you boot to your current OS.

Spoiler (Click to View)

You can remove it in normal mode if you want to, the only requirement is will power.

Download fixlist.txt file and save it to the Desktop.

NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

RE: Weird Virus (virus.neshta) [STILL NEED HELP!!!] - Brainsdotco - May 8, 2018

Aw dude you are formed, this is one pickle

RE: Weird Virus (virus.neshta) [STILL NEED HELP!!!] - ltpg2010 - Jul 8, 2018

lets hope and see what happens

RE: Weird Virus (virus.neshta) [STILL NEED HELP!!!] - VENI - Jul 15, 2018

(May 7, 2017 09:47 AM)ParadoxTheDev Wrote:  So i got this virus and its doing a few things, one when I try to open for example: Notepad++ its prompting saying to run in svchost.com. If i click yes sometimes it will open and other times it will open the wizard which asks me to chose what to run it in. This has resulted to me not being able to open 95% of the things on my pc. Here are a few

-Google Chrome
-Internet Explorer
-Mozila Firefox
-Explorer.exe
-CMD

I have bypassed this for some programs by for example opening: Explorer.exe in Explorer.exe so opening the program that wont open in itself, (If that makes any since)

My pc is currently on and in safe mode with networking, this allowed me to open and use google chrome. But still is prompting with svchost.com

I used malwareBytes to do a FULL scan yesterday and here is the main detection I kept getting.
[Image: .eJwFwdsNwyAMAMBdGADzsAtkG0QQiZpgBI76UXX...height=219]
The "Type" is virus.neshta


If you cant read the image here is a direct link
Spoiler (Click to View)

Also in the image it gives a directory in where the virus is, I DID delete the whole directory of where it was all occurring.


EDIT: So i did scans using RKILL64 and ADWcleaner but i was in safe mode on my PC I restarted my PC and redid them and got differnt results logs soon!


LOGS


ADWcleaner
Spoiler (Click to View)

RKILL64
Spoiler (Click to View)


Farbar Recovery Scan Tool
Spoiler (Click to View)

Use HitmanPro it is the best scanner. https://www.hitmanpro.com/en-us.aspx