[Ashley‌]

https://github.com/redpois0n/jrat-remover

There are build instructions in the readme. Made by the guy who made jRAT.

[The Scarabian]

Why the hell is this in the Griefing Section?

[Immoral Collective]

Just saying remove java for now and it will make the virus unable to run until you reinstall. Though it gives you time to send the .jar into virustotal and in about 4/5 days your av should be detecting it.

[Null Byte]

WHY ARE YOU ASKING HIM TO REINSTALL? It's an easy removal

Also holy fuck that is a poorly programmed rat. Look at all those startup keys.

---

---

OP, if nobody knows how to make a fixlist for this (rly knautschtabak?) then I will make one for you. Just give me the word.

[Null Byte]

Download attached fixlist.txt file and save it to the same directory as FRST.exe.
Download link: https://d.maxfile.ro/dmbeutaywz.txt (Right click --> Save as... Then rename to fixlist.txt)

Save all work before running this! Your computer will be rebooted.

NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work!

Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will reboot your computer and generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

After your reboot I want you to do another FRST scan. So the two logs I need form you are:
- FRST.txt
- Fixlog.txt

🤝
Null Byte

[Null Byte]

Ok nice. Hold on, I'll try this in a bit. I'm talking to a friend who has some suggestions as well.

Okay. Keep in mind that if you continue delaying, Jrat could keep replicating (potentially). So you may want to run this soon.

[Null Byte]

Wow. This is the first time I've been able to run normally for days. Stuff like website cookies and saved log-in information was deleted. I actually had to request a new randomly generated password so I could sign in, because the old one wasn't working for some reason.

---

Alright, here we gooo!

FRST.txt: http://www.filedropper.com/frst_2

Fixlog: http://www.filedropper.com/fixlog

And I forgot to turn off the "Addition" option in FRST, so I have that too: http://www.filedropper.com/addition_1

I hope that doesn't break things. :3

Looks much better! Is your computer running OK now?

[Null Byte]

Don't you think it is a bit impolite to just hijack another helper's thread? Especially after I told you that I am still helping?

@TheWallsPlayer There is still malware on your computer. The fix did not remove it all and your problem is faraway from being solved. I can prepare a new one, but I want you do decide for ONE helper first and stick to that one. Because now it is really confusing who is helping here and I am not in the mood to prepare a fix just to see that you have followed instructions of other helpers in the meanwhile. That is not only annoying, it can also be dangerous with conflicting instructions.

Considering you wanted him to format, I had to intervene. Impolite or not, it's most important that OP gets the help he needs.

[Null Byte]

Do you even have proper training under your belt? No offence as I have previously seen you help in this section, but you have never revealed the answer to this question before.

Yeah, I like to think I'm pretty good at removing malware.

@knaut - what is the malware remaining on his system? Can you show me the fixlist you would administer here?