(Dec 23, 2014 01:21 PM)NoodleBot™ Wrote: Then do it the lazy way and boot into safe mode and delete it all.
And where might the files be located?
[FIXED] Accidentally Infected myself with own keylogger :s |
|
And where might the files be located? (Dec 23, 2014 01:23 PM)Shadow™ Wrote: And where might the files be located? Can you upload the stub and PM me a link? I'm going to do an analysis to see how this thing installed itself. Link to analysis: https://www.hybrid-analysis.com/sample/9...9b66af9a31 ^ Hybrid analysis not working on this. I'll try a different site. Link to analysis: https://malwr.com/submission/status/Zjdj...c4ODlmZTM/ It should be finished in ~10 minutes, then we can figure out how to remove this.  (Dec 23, 2014 01:26 PM)Null Byte Wrote: Can you upload the stub and PM me a link? I'm going to do an analysis to see how this thing installed itself. The analysis crashed. It happened to me a few days ago too. Fiat justitia ruat cælum
My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
Dec 23, 2014 01:49 PM
(This post was last modified: Dec 23, 2014 01:49 PM by Shadow™.)
Compiled a new stub with his compiler and uploaded to hybrid-analysis:
https://www.hybrid-analysis.com/sample/3...7dda95e249 Farbar still scanning (Dec 23, 2014 01:49 PM)Shadow™ Wrote: Compiled a new stub with his compiler and uploaded to hybrid-analysis: OK, it seems to have some sort of anti-emulation feature so I don't know if HA will be able to complete. And just post your logs on pastebin.com when you're done with that.
Dec 23, 2014 01:53 PM
(This post was last modified: Dec 23, 2014 01:54 PM by Shadow™.)
FRST: http://privatepaste.com/8f51200454
Addition: http://privatepaste.com/a6ee040d27 Shortcut: http://privatepaste.com/7646a54832 Analysis of the compiler: https://www.hybrid-analysis.com/sample/3...98eefd9f2/ (Dec 23, 2014 01:53 PM)Shadow™ Wrote: FRST: http://privatepaste.com/8f51200454 Boot into safe mode, then open up msconfig.exe. Under the Startup tab you should see something called DayZ Hack; disable it. Apply your changes. Open up the an C:\Users\jordan\AppData\Local\Temp\ and delete a file named DayZ Hack.exe. Upload C:\Windows\SysWOW64\PnkBstrA.exe to VirusTotal.com and post the link here. Reboot your computer. (Dec 23, 2014 01:59 PM)Null Byte Wrote: Boot into safe mode, then open up msconfig.exe. Under the Startup tab you should see something called DayZ Hack; disable it. Apply your changes. Open up the an C:\Users\jordan\AppData\Local\Temp\ and delete a file named DayZ Hack.exe. Upload C:\Windows\SysWOW64\PnkBstrA.exe to VirusTotal.com and post the link here. Reboot your computer. Owner of the keylogger told me how to remove it. Thanks for the help tho :). http://www.neuber.com/taskmanager/proces...a.exe.html Looks like battlefield or something (Dec 23, 2014 02:06 PM)Shadow™ Wrote: Owner of the keylogger told me how to remove it. Thanks for the help tho :). Alright, sounds good. Let us know if you need any more help. (Dec 23, 2014 01:59 PM)Null Byte Wrote: Boot into safe mode, then open up msconfig.exe. Under the Startup tab you should see something called DayZ Hack; disable it. Apply your changes. Open up the an C:\Users\jordan\AppData\Local\Temp\ and delete a file named DayZ Hack.exe. Upload C:\Windows\SysWOW64\PnkBstrA.exe to VirusTotal.com and post the link here. Reboot your computer. It's needed to run Battlefield, however it have a spyware-like behavior, nothing you can do. (Dec 23, 2014 02:06 PM)Shadow™ Wrote: Owner of the keylogger told me how to remove it. Thanks for the help tho :). Run my reply above. Fiat justitia ruat cælum
My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry. 
Hi,
Just wanted to drop in to say something. Null Byte Wrote:Upload C:\Windows\SysWOW64\PnkBstrA.exe to VirusTotal.com and post the link here. PnkBstrA.exe is a legitimate file. It is part of an anti-cheat program thingymabob. 🎉 Null Byte Wrote:Open up the an C:\Users\jordan\AppData\Local\Temp\ and delete a file named DayZ Hack.exe Whattttt, is that it?!?! I'm seeing tons of malicious stuff in his temp folder! 🙃 But anyways, since the issue has been resolved, I hope someone closes this thread soon. 🎉 Malware Removal Team (MRT) will forever live on.
One of the Original Three: Brandenx781 Deltron RDCA (Dec 23, 2014 11:50 PM)Brandenx781 Wrote: Hi, You might want to harass Paradoxum for that, or one of the original three 😎 Fiat justitia ruat cælum
My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry. |
|
|
