May 20, 2015 03:13 AM
(This post was last modified: May 20, 2015 03:40 AM by Dafuq.)
Hey, I need to get my Laptop Checked, I downloaded njRat from this thread - https://hackforums.net/showthread.php?tid=3924408
and Suddenly noticed by mouse was moving, webpage refreshing..
As soon as I checked it, the person stopped operating my Laptop.
Now I cant post on that thread about the problem for some reason.
What the hell happened? Why would xVulnerables do all this??
Wow that's quite weird, considering the last time he updated the thread (with a new link presumably?) was in March.
(May 11, 2015 09:15 PM)Tonight Wrote: If I get banned for harassment you guys better fix Orchid's diet before you help him fix his computer
I Think OP needs help with checking his system in the case that this has happened and he is infected.
My posts are getting deleted!!!!
May 20, 2015 03:17 AM
(This post was last modified: May 20, 2015 03:18 AM by Knautschtabak.)
If you can, get on another computer and disconnect the infected one from the network.
------
Backdoor warning: We can remove the visible infection signs, but due to the nature of this type of malware, no one can guarantee the trustworthiness of your computer. If you want to use it for anything important like online-banking, reformat and install of your operating system is the safest option.
Note: Please change any of your passwords from a non-infected computer.
------
Please read through the points below to ensure this process moves as quickly and efficiently as possible. - Ensure you read through my instructions thoroughly, and carry out each step in the order specified.
- Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in providing the best set of instructions for you.
- Please backup important files before proceeding with my instructions. Malware removal can be unpredictable at times.
- If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
- I will notify you when I believe your computer is free of malware. Please bear in mind, absence of symptoms does not necessarily correlate to absence of malware, so please wait until the "All Clean".
------
Step 1: Farbar Recovery Scan Tool (FRST) Scan- Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
- Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
- Right-Click FRST.exe or FRST64.exe and select Run as Administrator
- Click Yes to the disclaimer.
- Ensure the Addition.txt box is checked.
- Click the Scan button and let the program run.
- Upon completion, click OK, then OK on the Addition.txt pop up screen.
- Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.
Step 2: RogueKiller- Download RogueKiller (32 bit)/RogueKiller (64 bit) and save the file to your Desktop.
- Note: Download and run the version compatible with your system (32 or 64-bit). Download the first (32-bit) if you're unsure.
- Close any running programs.
- Right-Click RogueKiller.exe and select Run as administrator to run the program.
- Allow the Prescan to complete. Upon completion, a window will open. Click Accept.
- A browser window may open. Close the browser window.
- Click
![[Image: jpgUwzp.png]](https://i.imgur.com/jpgUwzp.png) . Upon completion, click ![[Image: phPvmc6.png]](https://i.imgur.com/phPvmc6.png) .
- Close the program. Do not fix anything!
- A log (RKreport.txt) will be open. Copy the contents of the log to pastebin.com, click Submit and paste the link to it in your next reply.
DO NOT DEAL WITH THIS MEMBER
(May 20, 2015 03:17 AM)Dafuq Wrote: My posts are getting deleted!!!!
stfu already,your posts are here
![[Image: 04a55bcf0d.png]](https://puu.sh/hU0G9/04a55bcf0d.png)
(May 20, 2015 03:14 AM)Autocorrect Wrote: Wow that's quite weird, considering the last time he updated the thread (with a new link presumably?) was in March.
True, but it's linked to his website I believe which he can update whenever
May 20, 2015 03:24 AM
(This post was last modified: May 20, 2015 04:33 AM by Dafuq.)
(May 20, 2015 03:18 AM)Meow Wrote: stfu already,your posts are here
If they are there, I cant see them!! That shit never happens!
(May 20, 2015 03:17 AM)Knautschtabak Wrote: If you can, get on another computer and disconnect the infected one from the network.
------
Backdoor warning: We can remove the visible infection signs, but due to the nature of this type of malware, no one can guarantee the trustworthiness of your computer. If you want to use it for anything important like online-banking, reformat and install of your operating system is the safest option.
Note: Please change any of your passwords from a non-infected computer.
------
Please read through the points below to ensure this process moves as quickly and efficiently as possible.- Ensure you read through my instructions thoroughly, and carry out each step in the order specified.
- Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in providing the best set of instructions for you.
- Please backup important files before proceeding with my instructions. Malware removal can be unpredictable at times.
- If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
- I will notify you when I believe your computer is free of malware. Please bear in mind, absence of symptoms does not necessarily correlate to absence of malware, so please wait until the "All Clean".
------
Step 1: Farbar Recovery Scan Tool (FRST) Scan- Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
- Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
- Right-Click FRST.exe or FRST64.exe and select Run as Administrator
- Click Yes to the disclaimer.
- Ensure the Addition.txt box is checked.
- Click the Scan button and let the program run.
- Upon completion, click OK, then OK on the Addition.txt pop up screen.
- Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.
Step 2: RogueKiller- Download RogueKiller (32 bit)/RogueKiller (64 bit) and save the file to your Desktop.
- Note: Download and run the version compatible with your system (32 or 64-bit). Download the first (32-bit) if you're unsure.
- Close any running programs.
- Right-Click RogueKiller.exe and select Run as administrator to run the program.
- Allow the Prescan to complete. Upon completion, a window will open. Click Accept.
- A browser window may open. Close the browser window.
- Click . Upon completion, click .
- Close the program. Do not fix anything!
- A log (RKreport.txt) will be open. Copy the contents of the log to pastebin.com, click Submit and paste the link to it in your next reply.
From the first scan -
Addition.txt - http://pastebin.com/3pcSGfa2
FRST.txt - http://pastebin.com/1LHnEs9V
RKreport.txt - http://pastebin.com/bxYxVQse
I have posted all reports.
From the first scan -
Addition.txt - http://pastebin.com/3pcSGfa2
FRST.txt - http://pastebin.com/1LHnEs9V
2nd scan
RKreport.txt - http://pastebin.com/bxYxVQse
DO NOT DEAL WITH THIS MEMBER
May 20, 2015 06:56 AM
(This post was last modified: May 20, 2015 06:56 AM by mrfong.)
@op i think i'm facing the same problem, njrat isnt running and roguekiller detected it and all my passwords are hacked my gmail is hacked, same goes for my paypal ,all happend 2 hours ago! wtf
Edit: I'm not sure if it's the same problem but i'm just thinking that it might be the same
(May 20, 2015 06:56 AM)mrfong Wrote: @op i think i'm facing the same problem, njrat isnt running and roguekiller detected it and all my passwords are hacked my gmail is hacked, same goes for my paypal ,all happend 2 hours ago! wtf
Edit: I'm not sure if it's the same problem but i'm just thinking that it might be the same
I guess there is some issue with njRAT!
DO NOT DEAL WITH THIS MEMBER
I can confirm this software is backdoored by xVulnerable.
Did my analysis, network communication, file drops and startup can confirm it.
(May 20, 2015 06:59 AM)HIGH PAID FELLA Wrote: I can confirm this software is backdoored by xVulnerable.
Did my analysis, network communication, file drops and startup can confirm it.
I am pretty sure the MRT team can look into this?
DO NOT DEAL WITH THIS MEMBER
(May 20, 2015 06:57 AM)Dafuq Wrote: I guess there is some issue with njRAT! I think so , also , i lost 360 slave on njrat , when i get one they dissaper, and i downloaded njrat and roguekiller recently so it might be njrat or something old, not sure though
(May 20, 2015 07:18 AM)mrfong Wrote: I think so , also , i lost 360 slave on njrat , when i get one they dissaper, and i downloaded njrat and roguekiller recently so it might be njrat or something old, not sure though
Lets c what the outcome is, but for now, why is MRT taking so long to respond.?
|
