[Knautschtabak]

Hello tahir.

Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Ensure you read through my instructions thoroughly, and carry out each step in the order specified.
  


• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in providing the best set of instructions for you.
  


• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable at times.
  


• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
  


• I will notify you when I believe your computer is free of malware. Please bear in mind, absence of symptoms does not necessarily correlate to absence of malware, so please wait until the "All Clean".
  

------

You have no Antivirus installed. Is there any particular reason for it?

You have a Java Backdoor on your system that is known by the detection name Artemis Backdoor.
Before we start removal I need to check some entries of your logs.

Step 1: Folder Options

• Press the Windows Key + r on your keyboard at the same time. Type Control Folders and click OK.
  


• Click View. Under Hidden files and folders:
  


• Place a checkmark next to Show hidden files, folders and drives.
  


• Remove the checkmark next to Hide extensions for known file types.
  


• Remove the checkmark next to Hide protected operating system Files (Recommended).
  


• Click Apply followed by OK.
  

Step 2: VirusTotal Upload

• Please go to VirusTotal.com.
  


• Click Choose File and locate the following file:
  
  
  • C:\Users\Tahir\AppData\Local\Google\Chrome\User Data\Default\Extensions\bknhkbgfhgkkjlioehiclhcgjiiaooeg
    
  
  
  
  


• ​Click Scan it!.
  


• If you receive the following notification: File already analysed click Reanalyse.
  


• Once the file has been analyzed, copy the page URL at the top of the window and paste in your next reply.
  


• Please do the same for the files below:
  • C:\Users\Tahir\AppData\Roaming\programs.vc
    
  
  
  
  

Step 3: Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key + r on your keyboard at the same time. Type Notepad and click OK.
  


• Copy the entire contents of the codebox below and paste into the Notepad document.
  
  Code

  start
CreateRestorePoint:
Folder: C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
Folder: C:\Users\Tahir\AppData\Roaming\4185E59E-AFA6-40EF-9F80-1F7D07CF3218
Folder: C:\ProgramData\Windows Services
end


• Click File, Save As and type fixlist.txt as the File Name.
  


• Important: The file must be saved in the same location as FRST.exe.
  

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST.exe and select Run as administrator to run the program.
  


• Click Fix.
  


• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log to pastebin.com and paste the link to it in your next reply.
  

[Snoopy]

Hello tahir.

Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Ensure you read through my instructions thoroughly, and carry out each step in the order specified.
  


• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in providing the best set of instructions for you.
  


• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable at times.
  


• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
  


• I will notify you when I believe your computer is free of malware. Please bear in mind, absence of symptoms does not necessarily correlate to absence of malware, so please wait until the "All Clean".
  

------

You have no Antivirus installed. Is there any particular reason for it?

You have a Java Backdoor on your system that is known by the detection name Artemis Backdoor.
Before we start removal I need to check some entries of your logs.

Step 1: Folder Options

• Press the Windows Key + r on your keyboard at the same time. Type Control Folders and click OK.
  


• Click View. Under Hidden files and folders:
  


• Place a checkmark next to Show hidden files, folders and drives.
  


• Remove the checkmark next to Hide extensions for known file types.
  


• Remove the checkmark next to Hide protected operating system Files (Recommended).
  


• Click Apply followed by OK.
  

Step 2: VirusTotal Upload

• Please go to VirusTotal.com.
  


• Click Choose File and locate the following file:
  
  
  • C:\Users\Tahir\AppData\Local\Google\Chrome\User Data\Default\Extensions\bknhkbgfhgkkjlioehiclhcgjiiaooeg
    
  
  
  
  


• ​Click Scan it!.
  


• If you receive the following notification: File already analysed click Reanalyse.
  


• Once the file has been analyzed, copy the page URL at the top of the window and paste in your next reply.
  


• Please do the same for the files below:
  • C:\Users\Tahir\AppData\Roaming\programs.vc
    
  
  
  
  

Step 3: Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key + r on your keyboard at the same time. Type Notepad and click OK.
  


• Copy the entire contents of the codebox below and paste into the Notepad document.
  
  Code

  start
CreateRestorePoint:
Folder: C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
Folder: C:\Users\Tahir\AppData\Roaming\4185E59E-AFA6-40EF-9F80-1F7D07CF3218
Folder: C:\ProgramData\Windows Services
end


• Click File, Save As and type fixlist.txt as the File Name.
  


• Important: The file must be saved in the same location as FRST.exe.
  

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST.exe and select Run as administrator to run the program.
  


• Click Fix.
  


• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log to pastebin.com and paste the link to it in your next reply.
  

Thank you for your reply. I assumed Malwarebytes Antimalware counts as an antivirus? If not, which one would you recommend?

When I navigate to C:\Users\Tahir\AppData\Local\Google\Chrome\User Data\Default\Extensions\bknhkbgfhgkkjlioehiclhcgjiiaooeg there is only a list of folders, this particular folder contains 2 files, Cached Theme.pak and manifest.json. It also contains an image folder which contains a few images which I recognise from a custom chrome theme I made a while back.

I'm presuming the other folders contain chrome extension files (based on the names of the files within them)

Scan for programs.vc: https://www.virustotal.com/en/file/e3b0c...438182918/

fixlist.txt: http://pastebin.com/2ak3hbdc

[Knautschtabak]

These folders

C:\ProgramData\541099
C:\ProgramData\541199
C:\Users\Tahir\AppData\Roaming\4185E59E-AFA6-40EF-9F80-1F7D07CF3218

contain log files. The first two are definitely from the RAT, not sure about the third. You may take a look into them to see what the RAT captured. Note: The FRST fix will remove the RAT folders.

You have disabled entries in msconfig that are related to your Babylon RAT. If you really want to get rid of them, you should remove Babylon.

Step 1: Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key + r on your keyboard at the same time. Type Notepad and click OK.
  


• Copy the entire contents of the codebox below and paste into the Notepad document.
  
  Code

  start
CreateRestorePoint:
CloseProcesses:
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "Client.jar" /f
Reg: reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder /v "Client.jar" /f
HKU\S-1-5-21-2553393960-3600394711-1477681348-1007\...\RunOnce: [Babylon RAT] => C:\ProgramData\Babylon RAT\client.exe
Startup: C:\Users\Tahir\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.jar [2015-07-27] ()
HKU\S-1-5-21-2553393960-3600394711-1477681348-1007\Software\Classes\exefile:  <===== ATTENTION!
2015-07-27 01:09 - 2015-07-27 01:09 - 00244792 _____ C:\Users\Tahir\AppData\Roaming\1115448083.jar
2015-07-27 01:03 - 2015-07-27 01:03 - 00031232 _____ (Microsoft) C:\Users\Tahir\Documents\usersdat.exe
2015-07-27 00:58 - 2015-07-27 23:19 - 000000 __SHD C:\ProgramData\541099
2015-07-27 00:58 - 2015-07-27 00:58 - 0000006 __RSH C:\ProgramData\7433cdb324b04dd5e3c3db213381216c7c539baa
2015-07-27 00:58 - 2015-07-27 00:58 - 000000 __SHD C:\ProgramData\541199
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_1600531638122434154.dll
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_1953036125835962126.dll
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_3109344135661366674.dll
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_3942053402218933952.dll
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_5122581650076520125.dll
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_668736564603157120.dll
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_7875434675044394057.dll
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_8917667986274682635.dll
EmptyTemp:
end


• Click File, Save As and type fixlist.txt as the File Name.
  


• Important: The file must be saved in the same location as FRST.exe.
  

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST.exe and select Run as administrator to run the program.
  


• Click Fix.
  


• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log to pastebin.com and paste the link to it in your next reply.
  

[Snoopy]

These folders

C:\ProgramData\541099
C:\ProgramData\541199
C:\Users\Tahir\AppData\Roaming\4185E59E-AFA6-40EF-9F80-1F7D07CF3218

contain log files. The first two are definitely from the RAT, not sure about the third. You may take a look into them to see what the RAT captured. Note: The FRST fix will remove the RAT folders.

You have disabled entries in msconfig that are related to your Babylon RAT. If you really want to get rid of them, you should remove Babylon.

Step 1: Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key + r on your keyboard at the same time. Type Notepad and click OK.
  


• Copy the entire contents of the codebox below and paste into the Notepad document.
  
  Code

  start
CreateRestorePoint:
CloseProcesses:
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "Client.jar" /f
Reg: reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder /v "Client.jar" /f
HKU\S-1-5-21-2553393960-3600394711-1477681348-1007\...\RunOnce: [Babylon RAT] => C:\ProgramData\Babylon RAT\client.exe
Startup: C:\Users\Tahir\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.jar [2015-07-27] ()
HKU\S-1-5-21-2553393960-3600394711-1477681348-1007\Software\Classes\exefile:  <===== ATTENTION!
2015-07-27 01:09 - 2015-07-27 01:09 - 00244792 _____ C:\Users\Tahir\AppData\Roaming\1115448083.jar
2015-07-27 01:03 - 2015-07-27 01:03 - 00031232 _____ (Microsoft) C:\Users\Tahir\Documents\usersdat.exe
2015-07-27 00:58 - 2015-07-27 23:19 - 000000 __SHD C:\ProgramData\541099
2015-07-27 00:58 - 2015-07-27 00:58 - 0000006 __RSH C:\ProgramData\7433cdb324b04dd5e3c3db213381216c7c539baa
2015-07-27 00:58 - 2015-07-27 00:58 - 000000 __SHD C:\ProgramData\541199
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_1600531638122434154.dll
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_1953036125835962126.dll
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_3109344135661366674.dll
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_3942053402218933952.dll
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_5122581650076520125.dll
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_668736564603157120.dll
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_7875434675044394057.dll
C:\Users\Tahir\AppData\Local\Temp\JNativeHook_8917667986274682635.dll
EmptyTemp:
end


• Click File, Save As and type fixlist.txt as the File Name.
  


• Important: The file must be saved in the same location as FRST.exe.
  

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST.exe and select Run as administrator to run the program.
  


• Click Fix.
  


• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log to pastebin.com and paste the link to it in your next reply.
  

Thank you for your reply. The folder C:\Users\Tahir\AppData\Roaming\4185E59E-AFA6-40EF-9F80-1F7D07CF3218 just contains a few .dat files, and a settings.bin file. I've also installed AVG Internet security 2015 as an antivirus alongside MBAM, and ran a whole computer scan, so maybe that's why some of the files are missing in the fixlist.txt?

I've also removed Babylon

fixlist.txt: http://pastebin.com/NiVJXrca

[PureLegend]

Did u download any software from any torrent search website? Try to delete em ASAP,coz alot of russian dudes likes to put rats into cracked software.Also Knautschtabak seems to be much helpful then me,so just follow his steps

[Knautschtabak]

Please check my ground rules again. They say:

Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in providing the best set of instructions for you.

If you are doing things on your own like system scans, you are making it hard for me to provide the best advice.
The fix seemed to work except for one detail. How is your computer doing?

DelFix

• Please download DelFix and save the file to your Desktop.
  


• Right-Click DelFix.exe and click Run as administrator.
  


• Remove the checkmark next to the following items:
  • Remove disinfection tools
    
  
  
  
  


• Place a checkmark next to the following items:
  • Create registry backup
    
  
  
  
  


• Click the Run button.
  

Reg Fix

• Press the Windows Key + r on your keyboard at the same time. Type Notepad and click OK.
  


• Copy the entire contents of the codebox below and paste into the Notepad document.
  
  Code

  Windows Registry Editor Version 5.00

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder]
"Client.jar"=-


• Click Format. Ensure Wordwrap is unchecked.
  


• Click File, Save As and name the file regfix.reg.
  


• Select All Files as the Save as type.
  


• Save the file to your Desktop.
  


• Locate regfix.regon your Desktop. Right-Click the file and click Merge with the Registry.
  


• Accept any prompts.
  


• Reboot your computer for the changes to take effect.
  

[Snoopy]

Please check my ground rules again. They say:

If you are doing things on your own like system scans, you are making it hard for me to provide the best advice.
The fix seemed to work except for one detail. How is your computer doing?

DelFix

• Please download DelFix and save the file to your Desktop.
  


• Right-Click DelFix.exe and click Run as administrator.
  


• Remove the checkmark next to the following items:
  • Remove disinfection tools
    
  
  
  
  


• Place a checkmark next to the following items:
  • Create registry backup
    
  
  
  
  


• Click the Run button.
  

Reg Fix

• Press the Windows Key + r on your keyboard at the same time. Type Notepad and click OK.
  


• Copy the entire contents of the codebox below and paste into the Notepad document.
  
  Code

  Windows Registry Editor Version 5.00

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder]
"Client.jar"=-


• Click Format. Ensure Wordwrap is unchecked.
  


• Click File, Save As and name the file regfix.reg.
  


• Select All Files as the Save as type.
  


• Save the file to your Desktop.
  


• Locate regfix.regon your Desktop. Right-Click the file and click Merge with the Registry.
  


• Accept any prompts.
  


• Reboot your computer for the changes to take effect.
  

Sorry it's just that you pointed out that I had no antivirus.

I've done everything that you said so far. I know you said absence of symptoms doesn't mean I'm clean but I haven't noticed any strange behaviour or any strange logins since.

What should I do now?

[Knautschtabak]

If you did the registry fix, post fresh FRST logs (including Addition.txt), so I can confirm that the bad entries are gone.

Farbar Recovery Scan Tool (FRST) Scan

• Right-Click FRST64.exe and select Run as Administrator
  


• Click Yes to the disclaimer.
  


• Ensure the Addition.txt box is checked.
  


• Click the Scan button and let the program run.
  


• Upon completion, click OK, then OK on the Addition.txt pop up screen.
  


• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.
  

[Snoopy]

If you did the registry fix, post fresh FRST logs (including Addition.txt), so I can confirm that the bad entries are gone.

Farbar Recovery Scan Tool (FRST) Scan

• Right-Click FRST64.exe and select Run as Administrator
  


• Click Yes to the disclaimer.
  


• Ensure the Addition.txt box is checked.
  


• Click the Scan button and let the program run.
  


• Upon completion, click OK, then OK on the Addition.txt pop up screen.
  


• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.
  

FRST.txt (exceeded pastebin size limit): http://paste2.org/ZWV1B6xg

Addition.txt: http://pastebin.com/sTGqjbWw

[Dedsec34]

bro just open the taskbar and search for weird name server that has exe in it and locate file delete everything and end task and your good to go even more help download AVG its free and perfect protection

[Nuworld]

bro just open the taskbar and search for weird name server that has exe in it and locate file delete everything and end task and your good to go even more help download AVG its free and perfect protection

Why are you interfering with the work of an Expert?
Your advise is miss cured.

[Knautschtabak]

Your logs look good now.

DelFix

• Please download DelFix and save the file to your Desktop.
  


• Double-click DelFix.exe to run the programme.
  


• Place a checkmark next to the following items:
  • Remove disinfection tools
    
  
  
  
  


• Click the Run button.
  

-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

[Snoopy]

Your logs look good now.

DelFix

• Please download DelFix and save the file to your Desktop.
  


• Double-click DelFix.exe to run the programme.
  


• Place a checkmark next to the following items:
  • Remove disinfection tools
    
  
  
  
  


• Click the Run button.
  

-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

Thank you so much for your help!