+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Infected] I believe I am infected can't confirm (/showthread.php?tid=5951147)
I believe I am infected can't confirm - y389525 - Mar 16, 2019
FRST.txt: https://hastebin.com/penavupive.md
Addition.txt: https://hastebin.com/ewayadebal.makefile
mbam.txt: https://hastebin.com/oxicifupej.sql
Rkill.txt: https://hastebin.com/defihesibi.cs
Please help.
RE: I believe I am infected can't confirm - 5chn4pp - Mar 16, 2019
(Mar 16, 2019 05:19 AM)y389525 Wrote: FRST.txt: https://hastebin.com/penavupive.md
Addition.txt: https://hastebin.com/ewayadebal.makefile
mbam.txt: https://hastebin.com/oxicifupej.sql
Rkill.txt: https://hastebin.com/defihesibi.cs
Please help.
All logs are clean, your computer is not infected. However this does not mean that the file is legit, it might be taking passwords while running for example. Again its impossible to know.
RE: I believe I am infected can't confirm - y389525 - Mar 16, 2019
(Mar 16, 2019 05:42 AM)5chn4pp Wrote: All logs are clean, your computer is not infected. However this does not mean that the file is legit, it might be taking passwords while running for example. Again its impossible to know.
Not sure if its just me but HF seems to be running pretty slow for me today, also I downloaded but never executed the file so I can't tell if it is clean. I scanned the program with mbam also at first and it came back like this. I quarantined it but when I restored it to scan it again it came back clean. I have already deleted the program.
First scan: https://hastebin.com/ugowuroren.sql
Restored from quarantine: https://hastebin.com/sukepegopo.sql
RE: I believe I am infected can't confirm - 5chn4pp - Mar 16, 2019
(Mar 16, 2019 05:46 AM)y389525 Wrote: Not sure if its just me but HF seems to be running pretty slow for me today, also I downloaded but never executed the file so I can't tell if it is clean. I scanned the program with mbam also at first and it came back like this. I quarantined it but when I restored it to scan it again it came back clean. I have already deleted the program.
First scan: https://hastebin.com/ugowuroren.sql
Restored from quarantine: https://hastebin.com/sukepegopo.sql
That's one of the files that it drops, also noted in the hybrid analysis.
For a faster internet, consider using a fast dns resolver, it might help:
Code
https://1.1.1.1/RE: I believe I am infected can't confirm - y389525 - Mar 16, 2019
(Mar 16, 2019 06:52 AM)5chn4pp Wrote: That's one of the files that it drops, also noted in the hybrid analysis.
For a faster internet, consider using a fast dns resolver, it might help:
[qoute]https://1.1.1.1/[/qoute] (HF) doesn't like this link apparently.
What do I do with or where do I place it? Also does this mean I am clean for now?
1.1.1.1/" target="_blank" rel="noopener" class="mycode_url">https:// 1.1.1.1/
RE: I believe I am infected can't confirm - 5chn4pp - Mar 16, 2019
(Mar 16, 2019 06:53 AM)y389525 Wrote: What do I do with or where do I place it? Also does this mean I am clean for now?
1.1.1.1/" target="_blank" rel="noopener" class="mycode_url">https:// 1.1.1.1/
Follow this:
https://support.opendns.com/hc/en-us/articles/228006987-Windows-7-Configuration
And use 1.1.1.1 and 1.0.0.1
And yes you are clean, but that file is still not safe to use.
RE: I believe I am infected can't confirm - y389525 - Mar 16, 2019
(Mar 16, 2019 07:22 AM)5chn4pp Wrote: Follow this:
https://support.opendns.com/hc/en-us/articles/228006987-Windows-7-Configuration
And use 1.1.1.1 and 1.0.0.1
And yes you are clean, but that file is still not safe to use.
Thank you.