Remove a JRAT? - SOLVED!!!

Avαlαr · Changed my username 7/6/18.

(Jun 12, 2015 01:38 PM)Null Byte Wrote: Okay. Keep in mind that if you continue delaying, Jrat could keep replicating (potentially). So you may want to run this soon.

O_o You're kidding. Why isn't this guy curing cancer?

(Jun 12, 2015 01:38 PM)⭐ ＰＲＯＦＩＴ ⭐ Wrote: I think i just fixed it on my own.....

no more java.exe or javaw.exe processess running after restarting my computer!

I deleted all the jar files in C:\users\Austin & in the startup folder

i also removed all scheduled tasks that would put the jar files there on startup.

:D

I hope its gone for good!

tell tell tell tell tell tell tell tell tell tell tell

how how how how how how how how how

⭐ ＰＲＯＦＩＴ ⭐

(Jun 12, 2015 01:38 PM)Null Byte Wrote: Okay. Keep in mind that if you continue delaying, Jrat could keep replicating (potentially). So you may want to run this soon.

it sure as hell does replicate.

i deleted like 200 .jar files(made by it).

Avαlαr · Changed my username 7/6/18.

Wow. This is the first time I've been able to run normally for days. Stuff like website cookies and saved log-in information was deleted. I actually had to request a new randomly generated password so I could sign in, because the old one wasn't working for some reason.

Alright, here we gooo!

FRST.txt: http://www.filedropper.com/frst_2

Fixlog: http://www.filedropper.com/fixlog

And I forgot to turn off the "Addition" option in FRST, so I have that too: http://www.filedropper.com/addition_1

I hope that doesn't break things. :3

Jun 12, 2015 04:54 PM

(Jun 12, 2015 02:10 PM)Avαlαr Wrote: Wow. This is the first time I've been able to run normally for days. Stuff like website cookies and saved log-in information was deleted. I actually had to request a new randomly generated password so I could sign in, because the old one wasn't working for some reason.

Alright, here we gooo!

FRST.txt: http://www.filedropper.com/frst_2

Fixlog: http://www.filedropper.com/fixlog

And I forgot to turn off the "Addition" option in FRST, so I have that too: http://www.filedropper.com/addition_1

I hope that doesn't break things. :3

Looks much better! Is your computer running OK now?

Avαlαr · Jun 12, 2015 06:19 PM

(Jun 12, 2015 04:54 PM)Null Byte Wrote: Looks much better! Is your computer running OK now?

Yes! Just like normal! Thank you Knautschtabak and Null Byte for your help!

PS: What would you guys recommend for cleaning up my PC? I'm talking Grade-A stuff here; I must have a lot of crap on my PC that I don't want. :3

YekiM · (This post was last modified: Jun 12, 2015 06:38 PM by YekiM.)

(Jun 12, 2015 12:51 PM)⭐ ＰＲＯＦＩＴ ⭐ Wrote: I think i have the same thing on my PC.

hopefully a fix can be found for us both.

https://www.virustotal.com/en/file/190b4.../analysis/
^ scan of the infected file

Hi Austin,

Fixes, fixlists and removal advice are on a case-by-case basis, and using the same fixlist found in this thread may render your system inoperable as the nature of your problem (although might seem to be the same issue) could be different. I would suggest you make a new thread with fresh FRST.txt, addition.txt and rkreport.txt. Refer to the spoiler below if you need help with the instructions. Furthermore, deleting the entries in both MSCONFIG (or just the start-up folder) & the services does not remove the malware completely from your system, as the entries will remain dormant until it can find a way to activate itself again (usually through human error, system restoring or antivirus conflicts.)

Spoiler (Click to View)

Knautschtabak · (This post was last modified: Jun 12, 2015 09:05 PM by Knautschtabak.)

(Jun 12, 2015 01:22 PM)Null Byte Wrote: Download attached fixlist.txt file and save it to the same directory as FRST.exe.
Download link: https://d.maxfile.ro/dmbeutaywz.txt (Right click --> Save as... Then rename to fixlist.txt)

Save all work before running this! Your computer will be rebooted.

NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work!

Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will reboot your computer and generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

After your reboot I want you to do another FRST scan. So the two logs I need form you are:
- FRST.txt
- Fixlog.txt

🤝
Null Byte

Don't you think it is a bit impolite to just hijack another helper's thread? Especially after I told you that I am still helping?

@TheWallsPlayer There is still malware on your computer. The fix did not remove it all and your problem is faraway from being solved. I can continue with assistance, but I want you do decide for ONE helper first and stick to that one. Because now it is really confusing who is helping here and I am not in the mood to prepare a fix just to see that you have followed instructions of other helpers in the meanwhile. That is not only annoying, it can also be dangerous with conflicting instructions.

Jun 12, 2015 09:06 PM

(Jun 12, 2015 09:00 PM)Knautschtabak Wrote: Don't you think it is a bit impolite to just hijack another helper's thread? Especially after I told you that I am still helping?

@TheWallsPlayer There is still malware on your computer. The fix did not remove it all and your problem is faraway from being solved. I can prepare a new one, but I want you do decide for ONE helper first and stick to that one. Because now it is really confusing who is helping here and I am not in the mood to prepare a fix just to see that you have followed instructions of other helpers in the meanwhile. That is not only annoying, it can also be dangerous with conflicting instructions.

Considering you wanted him to format, I had to intervene. Impolite or not, it's most important that OP gets the help he needs.

Retribute · Jun 12, 2015 09:49 PM

(Jun 12, 2015 09:06 PM)Null Byte Wrote: Considering you wanted him to format, I had to intervene. Impolite or not, it's most important that OP gets the help he needs.

Do you even have proper training under your belt? No offence as I have previously seen you help in this section, but you have never revealed the answer to this question before.

Jun 12, 2015 10:25 PM

(Jun 12, 2015 09:49 PM)Retribute Wrote: Do you even have proper training under your belt? No offence as I have previously seen you help in this section, but you have never revealed the answer to this question before.

Yeah, I like to think I'm pretty good at removing malware.

@knaut - what is the malware remaining on his system? Can you show me the fixlist you would administer here?

⭐ ＰＲＯＦＩＴ ⭐ · Jun 12, 2015 10:36 PM

(Jun 12, 2015 06:36 PM)YekiM Wrote: Hi Austin,

Fixes, fixlists and removal advice are on a case-by-case basis, and using the same fixlist found in this thread may render your system inoperable as the nature of your problem (although might seem to be the same issue) could be different. I would suggest you make a new thread with fresh FRST.txt, addition.txt and rkreport.txt. Refer to the spoiler below if you need help with the instructions. Furthermore, deleting the entries in both MSCONFIG (or just the start-up folder) & the services does not remove the malware completely from your system, as the entries will remain dormant until it can find a way to activate itself again (usually through human error, system restoring or antivirus conflicts.)

Spoiler (Click to View)

for now, its fixed, if i see anything suspicious at all in the future i will post here.

Knautschtabak · (This post was last modified: Jun 13, 2015 01:46 AM by Knautschtabak.)

(Jun 12, 2015 09:06 PM)Null Byte Wrote: Considering you wanted him to format, I had to intervene. Impolite or not, it's most important that OP gets the help he needs.

Firstly reformat is the recommended action for backdoors. Every helper of reputable malware removal forums will say the same and inform the user about this fact.
Secondly I reacted upon him telling me he considered reformatting and he already downloaded a Windows torrent. I wanted him to decide before I proceed, so I don't prepare a fix for nothing. I always told him to post FRST scans if he wants to proceed. Thirdly, your fix came after the decision to proceed with removal. That was not necessary, nor professional.

We helpers in this section look out for each other, which is great. But this should be done in a professional way that does not create confusion for the user or creates the danger of proposing two conflicting fixes to the user.
If I have any problem with a (trained!) helper's fix in the section, I write a PM. So do the other helpers if they see a problem with my fix. That avoids confusion in the thread and that is also what I would like you to do if you see something troubling. I take any criticism seriously. So please, keep watching out, but don't hijack threads.

(Jun 12, 2015 10:25 PM)Null Byte Wrote: @knaut - what is the malware remaining on his system? Can you show me the fixlist you would administer here?

Look into the One Month Created files section of the last FRST.txt and you will see remaining .jar files of the RAT.

You will also see that there is lots of adware on the system that needs to be fixed as well, or he will get other infections very soon through malvertising and the remaining security holes on the system.

Avαlαr · Changed my username 7/6/18.

(Jun 13, 2015 01:19 AM)Knautschtabak Wrote: *snip

Look into the One Month Created files section of the last FRST.txt and you will see remaining .jar files of the RAT.

You will also see that there is lots of adware on the system that needs to be fixed as well, or he will get other infections very soon through malvertising and the remaining security holes on the system.

Ok, so how do you want me to do that? :P

Also, I uninstalled Kaspersky and reinstalled what I had before that whole mess had happened, which was Avast!. I did a scan with it, and it found somewhere around 650 of those jrat files, even though they weren't doing anything. So I "fixed" them, (that's what one of the options said, I don't necessarily know what it means), and then did a "boot-scan"; something I've never heard of. Basically all it did was delete the files 1 by 1 before restarting my PC.

(Jun 12, 2015 09:06 PM)Null Byte Wrote: Considering you wanted him to format, I had to intervene. Impolite or not, it's most important that OP gets the help he needs.

Yeah trust me, I was the one who wanted to reformat. In fact if it were possible for me to reformat, I would have done that instead of all of this. That would have certainly fixed everything, lol.

Knautschtabak · Jun 13, 2015 04:02 AM

Since you did a lot of changes to your system in the meanwhile I will need a fresh FRST scan.

Farbar Recovery Scan Tool (FRST) Scan

Right-Click FRST64.exe and select Run as Administrator

Click Yes to the disclaimer.

Ensure the Addition.txt box is checked.

Click the Scan button and let the program run.

Upon completion, click OK, then OK on the Addition.txt pop up screen.

Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.

Avαlαr · Jun 13, 2015 07:07 AM

(Jun 13, 2015 04:02 AM)Knautschtabak Wrote: Since you did a lot of changes to your system in the meanwhile I will need a fresh FRST scan.

Farbar Recovery Scan Tool (FRST) Scan
Right-Click FRST64.exe and select Run as Administrator

Click Yes to the disclaimer.

Ensure the Addition.txt box is checked.

Click the Scan button and let the program run.

Upon completion, click OK, then OK on the Addition.txt pop up screen.

Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.

FRST.txt: http://www.filedropper.com/frst_3

Addition.txt: http://www.filedropper.com/addition_2

Login
Username/Email:
Password:	Lost Password?
	Remember me

Possibly Related Threads...
Thread / Author	Replies	Views	Last Post
[Infected] How do I remove jrat? by ⭐ ＰＲＯＦＩＴ ⭐Jun 12, 2015 09:36 AM	2	564	Jun 12, 2015 09:36 AM Last Post: ⭐ ＰＲＯＦＩＴ ⭐
Can't remove extension "parieCecchoP" [SOLVED] by theAbsoluteAug 23, 2014 08:59 AM	9	117	Aug 23, 2014 08:59 AM Last Post: Aura
can't remove jRat + mac by daveyman123Nov 12, 2013 03:51 PM	7	239	Nov 12, 2013 03:51 PM Last Post: Spacе