+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Infected] Malware infection (/showthread.php?tid=6325985)
Malware infection - MrxRedBull - May 24, 2026
I think I got infected after downloading a cracked video game.
I suspect it’s a stealer, not a RAT or anything advanced — probably just stole my browser cookies and saved passwords.
I already changed the most important passwords, but I’d really appreciate help analyzing the logs.
Here are the FRST logs:
FRST.txt: https://pastebin.com/MQWeGQd9
Addition.txt: https://pastebin.com/MpZfjbAj
Symptoms / concerns:
Possible browser session theft
Saved passwords may have been extracted
Unsure if persistence or additional malware is present
If anyone experienced with malware analysis can check the logs and tell me what was executed or what I should still do, I’d appreciate it a lot.
Thanks in advance.
RE: Malware infection - DramaKing - May 24, 2026
I'm looking, but it was probably a Trojan that ran in the game's memory space and probably injected into other processes. FRST checks for persistence and any kind of suspicious modification to the system. Best way to analyze an encrypted stealer Trojan is a dynamic analysis using tools like ProcMon, Process Hacker, and Wireshark.
RE: Malware infection - 5chn4pp - May 24, 2026
It does look like you played around with some possible malware yesterday. I will create a fixlist for you in a moment.
RE: Malware infection - MrxRedBull - May 24, 2026
If anyone is interested, I can also provide the original download links and the forum thread where I got the file from. It came from a fairly well-known gaming forum and has been shared on multiple subreddits as well.
RE: Malware infection - DramaKing - May 24, 2026
Your crypto is probably gone, btw.
RE: Malware infection - 5chn4pp - May 24, 2026
(May 24, 2026 11:33 AM)MrxRedBull Wrote: If anyone is interested, I can also provide the original download links and the forum thread where I got the file from. It came from a fairly well-known gaming forum and has been shared on multiple subreddits as well.
You can send the links in a Convo, but do not paste them here. You would get reported for either infected links or advertising other forum.
Download fixlist.txt from the following link and save it to your Desktop:
fixlist.txt
Important: Both FRST and fixlist.txt must be in the same location (your Desktop) or the fix will not work.
Warning: This script was written specifically for your machine. Do not share it or run it on any other computer, it could cause damage.
1. Run FRST and click the Fix button once.
2. Wait for the process to complete. If the system needs to restart, let it do so normally and allow the tool to finish after reboot.
3. Once done, a log called Fixlog.txt will be created on your Desktop. Open it, copy its contents, and paste them into Pastebin. Share the Pastebin link in your next reply.
4. Also open C:\FRST\FixAudit\unknown-items.txt, C:\FRST\FixAudit\MozillaPolicies.reg, and C:\FRST\FixAudit\EdgePolicies.reg if they exist, paste their contents into Pastebin as well, and share those links too.
RE: Malware infection - DramaKing - May 24, 2026
(May 24, 2026 12:38 PM)5chn4pp Wrote: You can send the links in a Convo, but do not paste them here. You would get reported for either infected links or advertising other forum.
Download fixlist.txt from the following link and save it to your Desktop:
fixlist.txt
Important: Both FRST and fixlist.txt must be in the same location (your Desktop) or the fix will not work.
Warning: This script was written specifically for your machine. Do not share it or run it on any other computer, it could cause damage.
1. Run FRST and click the Fix button once.
2. Wait for the process to complete. If the system needs to restart, let it do so normally and allow the tool to finish after reboot.
3. Once done, a log called Fixlog.txt will be created on your Desktop. Open it, copy its contents, and paste them into Pastebin. Share the Pastebin link in your next reply.
4. Also open C:\FRST\FixAudit\unknown-items.txt, C:\FRST\FixAudit\MozillaPolicies.reg, and C:\FRST\FixAudit\EdgePolicies.reg if they exist, paste their contents into Pastebin as well, and share those links too.
This does stuff like delete a Python repo for UberEats, some unknown AppData folders and Minecraft, a Google Chromium archive that appears to be from a third-party source, a random Roblox file, a suspicious Forza Horizon cheat, and a clearly malicious executable called NitroSniper. Deleting the cracked game should be all you need to do, unless you have some idea about cleaning the game installer.
RE: Malware infection - MrxRedBull - May 24, 2026
(May 24, 2026 12:38 PM)5chn4pp Wrote: You can send the links in a Convo, but do not paste them here. You would get reported for either infected links or advertising other forum.
Download fixlist.txt from the following link and save it to your Desktop:
fixlist.txt
Important: Both FRST and fixlist.txt must be in the same location (your Desktop) or the fix will not work.
Warning: This script was written specifically for your machine. Do not share it or run it on any other computer, it could cause damage.
1. Run FRST and click the Fix button once.
2. Wait for the process to complete. If the system needs to restart, let it do so normally and allow the tool to finish after reboot.
3. Once done, a log called Fixlog.txt will be created on your Desktop. Open it, copy its contents, and paste them into Pastebin. Share the Pastebin link in your next reply.
4. Also open C:\FRST\FixAudit\unknown-items.txt, C:\FRST\FixAudit\MozillaPolicies.reg, and C:\FRST\FixAudit\EdgePolicies.reg if they exist, paste their contents into Pastebin as well, and share those links too.
I completed the fix and uploaded all requested files:
Fixlog: https://pastebin.com/PER5UvPn
unknown-items.txt: (edited to privatebin cause he get removed) https://privatebin.net/?325279a10753cf16#6oDzHrRhkQVqQT5KzECcZSV85MZyxBvAoCdVspvKHwke
MozillaPolicies.reg: https://pastebin.com/k8FD0nnJ
EdgePolicies.reg: https://pastebin.com/xMbguUTr
Could you please check if everything looks clean now?
RE: Malware infection - 5chn4pp - May 24, 2026
(May 24, 2026 12:54 PM)DramaKing Wrote: This does stuff like delete a Python repo for UberEats, some unknown AppData folders and Minecraft, a Google Chromium archive that appears to be from a third-party source, a random Roblox file, a suspicious Forza Horizon cheat, and a clearly malicious executable called NitroSniper. Deleting the cracked game should be all you need to do, unless you have some idea about cleaning the game installer.
No it does not. If you are referring to the PowerShell command, please read it correctly.
And if you can't read it, make ChatGPT read it for you.
(May 24, 2026 12:55 PM)MrxRedBull Wrote: I completed the fix and uploaded all requested files:
Fixlog: https://pastebin.com/PER5UvPn
unknown-items.txt: (edited to privatebin cause he get removed) https://privatebin.net/?325279a10753cf16#6oDzHrRhkQVqQT5KzECcZSV85MZyxBvAoCdVspvKHwke
MozillaPolicies.reg: https://pastebin.com/k8FD0nnJ
EdgePolicies.reg: https://pastebin.com/xMbguUTr
Could you please check if everything looks clean now?
Thank you.
Based on our Convo discussion, I would like for you to uninstall Discord, then run a clean FRST scan and provide FRST.txt and Addition.txt again.
RE: Malware infection - MrxRedBull - May 24, 2026
(May 24, 2026 12:57 PM)5chn4pp Wrote: No it does not. If you are referring to the PowerShell command, please read it correctly.
And if you can't read it, make ChatGPT read it for you.
Thank you.
Based on our Convo discussion, I would like for you to uninstall Discord, then run a clean FRST scan and provide FRST.txt and Addition.txt again.
Thank you.
I uninstalled Discord as requested and performed a fresh FRST scan.
Here are the new logs:
FRST.txt: https://pastebin.com/NmZ4YLLa
Addition.txt: https://pastebin.com/VNiGa6Xv
RE: Malware infection - 5chn4pp - May 24, 2026
(May 24, 2026 01:14 PM)MrxRedBull Wrote: Thank you.
I uninstalled Discord as requested and performed a fresh FRST scan.
Here are the new logs:
FRST.txt: https://pastebin.com/NmZ4YLLa
Addition.txt: https://pastebin.com/VNiGa6Xv
Download fixlist.txt from the following link and save it to your Desktop:
fixlist.txt
Important: Both FRST and fixlist.txt must be in the same location (your Desktop) or the fix will not work.
Warning: This script was written specifically for your machine. Do not share it or run it on any other computer, it could cause damage.
1. Run FRST and click the Fix button once.
2. Wait for the process to complete. If the system needs to restart, let it do so normally and allow the tool to finish after reboot.
3. Once done, a log called Fixlog.txt will be created on your Desktop. Open it, copy its contents, and paste them into Pastebin. Share the Pastebin link in your next reply.
4. Also open C:\FRST\FixAudit\defender-status.txt if it exists, paste the content into Pastebin as well, and share that link too.
RE: Malware infection - MrxRedBull - May 24, 2026
(May 24, 2026 02:12 PM)5chn4pp Wrote: Download fixlist.txt from the following link and save it to your Desktop:
fixlist.txt
Important: Both FRST and fixlist.txt must be in the same location (your Desktop) or the fix will not work.
Warning: This script was written specifically for your machine. Do not share it or run it on any other computer, it could cause damage.
1. Run FRST and click the Fix button once.
2. Wait for the process to complete. If the system needs to restart, let it do so normally and allow the tool to finish after reboot.
3. Once done, a log called Fixlog.txt will be created on your Desktop. Open it, copy its contents, and paste them into Pastebin. Share the Pastebin link in your next reply.
4. Also open C:\FRST\FixAudit\defender-status.txt if it exists, paste the content into Pastebin as well, and share that link too.
I completed the second fix and uploaded the requested files:
defender-status.txt: https://privatebin.net/?503df25b55ab7e64#DZGywWDud35YRbvqjZe25MdtVVfW9pnB4BqCuVPBhrkb
Fixlog.txt: https://pastebin.com/HZxPzwKE
RE: Malware infection - 5chn4pp - May 24, 2026
(May 24, 2026 02:19 PM)MrxRedBull Wrote: I completed the second fix and uploaded the requested files:
defender-status.txt: https://privatebin.net/?503df25b55ab7e64#DZGywWDud35YRbvqjZe25MdtVVfW9pnB4BqCuVPBhrkb
Fixlog.txt: https://pastebin.com/HZxPzwKE
The FRST logs are now clean. You can go ahead and install Discord again and use it as you normally would.
Since you have already ran Adwcleaner, Roguekiller and Malwarebytes, I would like for you to run a scan with ESET. You can find the instructions here:
https://hackforums.net/showthread.php?tid=6292574
Please reply to this thread with any results.