ProxiesFood: Unlimited Residential Proxy ◆ [#1] PURE RAT v4 // BEST HVNC RAT ◆ Spoof Call and Spoof SMS set any caller ◆ Private Crypter - Unique Private Stubs ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Whitehat • Blue Team • Defensive Security Malware, Rat, and Virus Removal › [Hijackthis Logs Included] susspect i'm being infected.. [Hijackthis Logs Included]

Thread Closed 

[Hijackthis Logs Included] susspect i'm being infected.. [Hijackthis Logs Included]
Stenography
Guest
 
Aug 31, 2011 05:51 AM
Ok so idk why but i susspect i'm being infected ..

Please tell me if you see something in my logs:Spoiler (Click to View)


Thanks in advance.
Paradoxum
Paradoxum Offline
Zzz
*****
HF Ub3r
Posts:
12,513
Threads:
1
Credibility:
000
Popularity:
235
βytes:
β 0
Game XP:
0
Sep 2, 2011 06:06 AM
Greetings,

Whilst I am in the process of scrutinizing your complete set of provided logs for any possible infections or problems, I ask for your forbearance. Understand that the process of analysis requires time and careful examination hence the need for a cautious response. Accuracy is of the essence. Once I come across infections, I shall present the finest methods of removal for your convenience.


In return for this service, I propose to you two conditions:
  1. You are not to create any new threads regarding the similar topic as it will waste another helper's time.

  2. You are not to install any new software in your system, as it may hinder our process thus making this futile.


In accordance to my terms, I also ask of you six things, stated below:
  1. You are not to modify the logs in any way. Failure to do so will instantly deprive you of this service.

  2. You are to paste each log separately at 'Pastebin' as it is. That is correct, no syntax highlighting, no editing - just the log purely. Post back the links for each log. You shall not hide them under spoiler codes.

  3. You are to provide the complete set of requested logs.

  4. You are to keep all your trusted tools that the scanners may detect in a password protected archive. This is to prevent them from being deleted as we've had complaints or refusal to use the scanner for this reason.

  5. You are to respond to every step I ask you to do using the format provided at the end of my post.

  6. You agree that I have the right to discontinue the analysis at any time, upon a violation of a single rule.


Provided that you will continue with this service, you hereby agree to the above statements. If you deem the conditions are portraying equality, I will willingly perform the analysis without further delay. Should you have any concerns or problems with the above conditions, or if you feel that I have overlooked your log, do inform me through a Private Message.


Thank you.

Genuinely yours,
Paradoxum
  • Optional Pre-Step

    With regard to my fourth condition, here are the steps on how to password protect your trusted tools momentarily. Do note that I would advise you to remove all the infections present in your system as I am not certain of the sources of these programs thereby I will not be able to verify whether they are backdoored or not.

    You are doing this at your own risk.



    • Create a new folder with the name of your choice.

    • Gather all of your tools into that folder.

    • If you do not have a file compressor, download '7-Zip' and install it.

    • After doing so, navigate to the said folder and right-click.
      • You are now presented with options.

      • Please chose 7-Zip > Add to Archive.

      • Under the Archive Name, enter any name you wish.

      • Set the Archive Format to 7z.

      • Set the Compression Level to Ultra.

      • Under Encryption fill in the Password field twice. You can tick Show Password if you desire.

      • When everything is done, click OK.



    • Wait for some time. The waiting time is determined by the size of your files.

    • 7-Zip will have produced the file for you.

    • Now we test the file by Right-click > 7-Zip > Extract Here.

    • A prompt asking you for the password should appear.

    • Select Cancel as this is for testing purposes only.

    • Now delete the other folder, empty your Recycle Bin and proceed with the instructions.




Note: After I have declared you ALL CLEAN, you may extract your files and dispose of the protected archive.
  • Pre-Step I

    Click 'here' to download Temp File Cleaner by OldTimer. Save it to your desktop.


    • Close any open windows.

    • Double-click TFC.exe and select Run when prompted to execute the program. It will close all open programs itself in order to run.

    • Click the Start button to begin the cleaning process.

    • Please let the program run uninterruptedly.

    • Once the cleaning has been done, your computer should automatically reboot. Otherwise, please do so when it does not.




  • Pre-Step II

    Download Security Check by screen317 from 'here' or 'here'.


    • Save it to your desktop.

    • Double-click SecurityCheck.exe and follow the instructions inside of the black box.

    • A Notepad document called Checkup.txt should automatically open; please post the contents of that document.





    • Double-click aswMBR.exe to run it. Windows Vista and Windows 7 users should run it as an administrator.

    • Click the Scan button to start the scan.

    • Upon the completion of the scan, click Save Log, and save it to your desktop. Post it in your next reply.




  • Prerequisite

    If you are having a problem running HijackThis as an administrator (Windows Vista and Windows 7), please follow the steps below.


    • On your desktop, right-click the HijackThis icon and select Properties.

    • Navigate to the Compatibility tab and put a check on the Run this program as an administrator box.

    • Click Apply > OK.

    • HijackThis should prompt you to run it as an administrator every time you open it.




  • Step 1

    Please run HijackThis as an administrator. Click Do a system scan only and place a check next to the following line(s) if present:

    R3 - URLSearchHook: (no name) - {67aa0145-a051-4660-a910-22da3bab1fa5} - (no file)
    R3 - URLSearchHook: (no name) - {f228c6a4-a593-4017-944c-4e7958fb3177} - (no file)

    Then, close all other open windows and click Fix Checked. You are to reboot your system afterwards.


  • Step 2

    Please run a free online scan with ESET Online Scanner by downloading ESET Smart Installer 'here'. Save it to your desktop.


    • Double-click esetsmartinstaller_enu.exe to execute the program.

    • Tick Yes, I accept the Terms of Use.

    • Click Start.

    • If this is your first time installing the scanner, allow the ActiveX Control to install.

    • Database download may take some time.

    • When done, make sure that the option Remove found threats is ticked. Under the and Advanced Settings, please put a check on the following options:
      • Scan for potentially unwanted applications

      • Enable Anti-Stealth Technology



    • Click Start.

    • Wait for the scan to finish.

    • Once it is finished, use Notepad to open the log file located at C:\Program Files\ESET\ESET Online Scanner\log.txt.

    • Copy and paste that log as a reply to this topic.




  • Step 3

    Please download Malwarebytes' Anti-Malware 'here'. This is a scanner which I will ask you to use.


    • Double-click mbam-setup.exe to install the application.

    • Make sure a check mark is placed next to Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.

    • If an update is found, it will download and install the latest version.

    • Once the program has loaded, select Perform Full Scan, then click Scan. The scan may take some time to finish, so please be patient.

    • When the scan is complete, click OK, then Show Results to view the results.

    • Make sure that everything is checked, and click Remove Selected.

    • When disinfection is completed, a log will open in Notepad and you may be prompted to restart. Restart if it tells you to.

    • The log is automatically saved by Malwarebytes' Anti-Malware and can be viewed by clicking the Logs tab in the interface.

    • Copy and paste the entire report in your next reply.




  • Step 4

    Download DDS.scr by sUBs from one of the following links and save it to your desktop.

    'Link 1'
    'Link 2'


    • Double-click on DDS.scr and a command window will appear. This is normal.

    • Shortly after two logs will appear, DDS.txt and Attach.txt.

    • A window will open instructing you save and post the logs.

    • Save the logs to a convenient place such as your desktop.

    • Copy the contents of both logs and post them at 'Pastebin' separately and post the links in your next reply.




  • In your next post, please provide the following:
    • A Fresh HijackThis (HJT) Log

    • aswMBR Log

    • Doesn't Do Squat (DDS) Logs
      • DDS.txt

      • Attach.txt



    • ESET Scan Log

    • Malwarebytes' Anti-Malware Scan Log

    • Security Check Log





  • Code
    [b]Step # [/b]
    [b]Problems Encountered: [/b]

    [b]Step # [/b]
    [b]Problems Encountered: [/b]

    [b]Step # [/b]
    [b]Problems Encountered: [/b]

    [b]Step # [/b]
    [b]Problems Encountered: [/b]

    [b]Link To Requested Logs: [/b]


Stenography
Guest
 
Sep 2, 2011 02:09 PM
(Sep 2, 2011 06:06 AM)Paradoxum Wrote:  Greetings,

Whilst I am in the process of scrutinizing your complete set of provided logs for any possible infections or problems, I ask for your forbearance. Understand that the process of analysis requires time and careful examination hence the need for a cautious response. Accuracy is of the essence. Once I come across infections, I shall present the finest methods of removal for your convenience.


In return for this service, I propose to you two conditions:
  1. You are not to create any new threads regarding the similar topic as it will waste another helper's time.

  2. You are not to install any new software in your system, as it may hinder our process thus making this futile.


In accordance to my terms, I also ask of you six things, stated below:
  1. You are not to modify the logs in any way. Failure to ooodo so will instantly deprive you of this service.

  2. You are to paste each log separately at 'Pastebin' as it is. That is correct, no syntax highlighting, no editing - just the log purely. Post back the links for each log. You shall not hide them under spoiler codes.

  3. You are to provide the complete set of requested logs.

  4. You are to keep all your trusted tools that the scanners may detect in a password protected archive. This is to prevent them from being deleted as we've had complaints or refusal to use the scanner for this reason.

  5. You are to respond to every step I ask you to do using the format provided at the end of my post.

  6. You agree that I have the right to discontinue the analysis at any time, upon a violation of a single rule.


Provided that you will continue with this service, you hereby agree to the above statements. If you deem the conditions are portraying equality, I will willingly perform the analysis without further delay. Should you have any concerns or problems with the above conditions, or if you feel that I have overlooked your log, do inform me through a Private Message.


Thank you.

Genuinely yours,
Paradoxum
  • Optional Pre-Step

    With regard to my fourth condition, here are the steps on how to password protect your trusted tools momentarily. Do note that I would advise you to remove all the infections present in your system as I am not certain of the sources of these programs thereby I will not be able to verify whether they are backdoored or not.

    You are doing this at your own risk.



    • Create a new folder with the name of your choice.

    • Gather all of your tools into that folder.

    • If you do not have a file compressor, download '7-Zip' and install it.

    • After doing so, navigate to the said folder and right-click.
      • You are now presented with options.

      • Please chose 7-Zip > Add to Archive.

      • Under the Archive Name, enter any name you wish.

      • Set the Archive Format to 7z.

      • Set the Compression Level to Ultra.

      • Under Encryption fill in the Password field twice. You can tick Show Password if you desire.

      • When everything is done, click OK.



    • Wait for some time. The waiting time is determined by the size of your files.

    • 7-Zip will have produced the file for you.

    • Now we test the file by Right-click > 7-Zip > Extract Here.

    • A prompt asking you for the password should appear.

    • Select Cancel as this is for testing purposes only.

    • Now delete the other folder, empty your Recycle Bin and proceed with the instructions.




Note: After I have declared you ALL CLEAN, you may extract your files and dispose of the protected archive.
  • Pre-Step I

    Click 'here' to download Temp File Cleaner by OldTimer. Save it to your desktop.


    • Close any open windows.

    • Double-click TFC.exe and select Run when prompted to execute the program. It will close all open programs itself in order to run.

    • Click the Start button to begin the cleaning process.

    • Please let the program run uninterruptedly.

    • Once the cleaning has been done, your computer should automatically reboot. Otherwise, please do so when it does not.




  • Pre-Step II

    Download Security Check by screen317 from 'here' or 'here'.


    • Save it to your desktop.

    • Double-click SecurityCheck.exe and follow the instructions inside of the black box.

    • A Notepad document called Checkup.txt should automatically open; please post the contents of that document.





    • Double-click aswMBR.exe to run it. Windows Vista and Windows 7 users should run it as an administrator.

    • Click the Scan button to start the scan.

    • Upon the completion of the scan, click Save Log, and save it to your desktop. Post it in your next reply.




  • Prerequisite

    If you are having a problem running HijackThis as an administrator (Windows Vista and Windows 7), please follow the steps below.


    • On your desktop, right-click the HijackThis icon and select Properties.

    • Navigate to the Compatibility tab and put a check on the Run this program as an administrator box.

    • Click Apply > OK.

    • HijackThis should prompt you to run it as an administrator every time you open it.




  • Step 1

    Please run HijackThis as an administrator. Click Do a system scan only and place a check next to the following line(s) if present:

    R3 - URLSearchHook: (no name) - {67aa0145-a051-4660-a910-22da3bab1fa5} - (no file)
    R3 - URLSearchHook: (no name) - {f228c6a4-a593-4017-944c-4e7958fb3177} - (no file)

    Then, close all other open windows and click Fix Checked. You are to reboot your system afterwards.


  • Step 2

    Please run a free online scan with ESET Online Scanner by downloading ESET Smart Installer 'here'. Save it to your desktop.


    • Double-click esetsmartinstaller_enu.exe to execute the program.

    • Tick Yes, I accept the Terms of Use.

    • Click Start.

    • If this is your first time installing the scanner, allow the ActiveX Control to install.

    • Database download may take some time.

    • When done, make sure that the option Remove found threats is ticked. Under the and Advanced Settings, please put a check on the following options:
      • Scan for potentially unwanted applications

      • Enable Anti-Stealth Technology



    • Click Start.

    • Wait for the scan to finish.

    • Once it is finished, use Notepad to open the log file located at C:\Program Files\ESET\ESET Online Scanner\log.txt.

    • Copy and paste that log as a reply to this topic.




  • Step 3

    Please download Malwarebytes' Anti-Malware 'here'. This is a scanner which I will ask you to use.


    • Double-click mbam-setup.exe to install the application.

    • Make sure a check mark is placed next to Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.

    • If an update is found, it will download and install the latest version.

    • Once the program has loaded, select Perform Full Scan, then click Scan. The scan may take some time to finish, so please be patient.

    • When the scan is complete, click OK, then Show Results to view the results.

    • Make sure that everything is checked, and click Remove Selected.

    • When disinfection is completed, a log will open in Notepad and you may be prompted to restart. Restart if it tells you to.

    • The log is automatically saved by Malwarebytes' Anti-Malware and can be viewed by clicking the Logs tab in the interface.

    • Copy and paste the entire report in your next reply.




  • Step 4

    Download DDS.scr by sUBs from one of the following links and save it to your desktop.

    'Link 1'
    'Link 2'


    • Double-click on DDS.scr and a command window will appear. This is normal.

    • Shortly after two logs will appear, DDS.txt and Attach.txt.

    • A window will open instructing you save and post the logs.

    • Save the logs to a convenient place such as your desktop.

    • Copy the contents of both logs and post them at 'Pastebin' separately and post the links in your next reply.




  • In your next post, please provide the following:
    • A Fresh HijackThis (HJT) Log

    • aswMBR Log

    • Doesn't Do Squat (DDS) Logs
      • DDS.txt

      • Attach.txt



    • ESET Scan Log

    • Malwarebytes' Anti-Malware Scan Log

    • Security Check Log





  • Code
    [b]Step # [/b]
    [b]Problems Encountered: [/b]

    [b]Step # [/b]
    [b]Problems Encountered: [/b]

    [b]Step # [/b]
    [b]Problems Encountered: [/b]

    [b]Step # [/b]
    [b]Problems Encountered: [/b]

    [b]Link To Requested Logs: [/b]


Gosh,i cleared temp and cleaned verything else with ATF cleaner CCleaner.
You just posted something that was saved in notepad and didn't analysed the logs
Paradoxum
Paradoxum Offline
Zzz
*****
HF Ub3r
Posts:
12,513
Threads:
1
Credibility:
000
Popularity:
235
βytes:
β 0
Game XP:
0
Sep 2, 2011 10:16 PM
(Sep 2, 2011 02:09 PM)Stenography Wrote:  Gosh,i cleared temp and cleaned verything else with ATF cleaner CCleaner.

Gosh, implying you think the rest of the steps are void? Forgive me when I say this, but you are an idiot. Do you think any helper will be able to determine that you used ATF-Cleaner or CCleaner? Just wow. I commend you for being able to read logs (oh wait, I only see one log) and not knowing the fact that the log above does not display whether or not you used such programs or any other log for this matter. Also, I hate to break it to you, but ATF-Cleaner is not for your operating system. Props to you. Also, I would like to say that your argument is invalid. What is the big deal if I ask you to clean your temporary files again? Will it make your computer explode? Oh joy, the hazards and difficulty of cleaning one's temporary files that one must never do it again for the sake of everyone's sanity.

Quote:You just posted something that was saved in notepad and didn't analysed the logs


I beg your pardon but my speeches aren't saved in Notepad for one. I did not analyse the log? Perhaps you should look at the first step? Or you should tell me how analysis is done, yes? I looked at your log for less than a minute. It's that easy and practically tells nothing in-depth of your system. If you have a problem with my asking for more logs to properly analyse your system (seeing as you can't read that you must post OTL logs instead of HijackThis then you have the guts to complain when the obvious problem is your reading capability) then I suggest you get out of this section. Also, I would like to enlighten you that helpers cannot and do not copy and paste similar instructions for everyone (except when certain idiots such as yourself forget the basics of scanning or attaching the log proving that they did scan and not assume helpers are magical people who can predict such a scan has been done) unless we want your system to crash. Which in all honesty, I wish to happen. TL;DR? Every log is different. It's not fucking rocket science.

So much for being a person asking for help that later complains when help is given. If you know what steps you should be doing then do it yourself. Do not post here and waste my time.
Next Oldest | Next Newest
Thread Closed 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by Tha SneakMar 1, 2025 09:45 PM 3 218 Mar 1, 2025 09:45 PM
Last Post: Tha Sneak
by Tha SneakMar 1, 2025 09:33 PM 1 116 Mar 1, 2025 09:33 PM
Last Post: Tha Sneak
by Tha SneakMar 1, 2025 09:33 PM 1 150 Mar 1, 2025 09:33 PM
Last Post: Tha Sneak