📢 Advertise on HF Today ◆ Private Crypter - Unique Private Stubs ◆ Spoof Call and Spoof SMS set any caller ◆ [#1] PURE RAT v4 // BEST HVNC RAT ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Whitehat • Blue Team • Defensive Security Malware, Rat, and Virus Removal › [Infected] Something Blocking MalwareBytes Installer

New Reply 
Infected 

Something Blocking MalwareBytes Installer
Sc00by
Sc00by Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,368
Threads:
116
Credibility:
1600
Popularity:
54
βytes:
β 0
Game XP:
0
Jan 18, 2016 07:54 AM
I recently downloaded a cracked version of something and was going to fast and wasn't paying attention and got myself a little malware.

I'm assuming it's just checking for the process name and killing it, if so then can i just change the process name?

Please PM me for my skype if you can help me out!

thanks a lot!
5chn4pp
5chn4pp Offline
Smile and the world smiles back
****
Equilibrium
Posts:
6,592
Threads:
97
Credibility:
000
Popularity:
422
βytes:
β 1,448
Game XP:
5,953
Jan 18, 2016 08:04 AM
Download Farbar Recovery Scan Tool and save it to your Desktop.
  • Right click to run as administrator. When the tool opens click Yes to the disclaimer.

  • Press the Scan button.

  • It will produce two logs called FRST.txt and Addition.txt in the same directory the tool is run from.

  • Please copy and paste the logs back here into your next reply.


Sc00by
Sc00by Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,368
Threads:
116
Credibility:
1600
Popularity:
54
βytes:
β 0
Game XP:
0
Jan 18, 2016 08:18 AM
(Jan 18, 2016 08:04 AM)5chn4pp Wrote:  Download Farbar Recovery Scan Tool and save it to your Desktop.
  • Right click to run as administrator. When the tool opens click Yes to the disclaimer.

  • Press the Scan button.

  • It will produce two logs called FRST.txt and Addition.txt in the same directory the tool is run from.

  • Please copy and paste the logs back here into your next reply.



http://pastebin.com/e2WJuUps
http://pastebin.com/Zf2NxXy7

Thanks for offering to help.
5chn4pp
5chn4pp Offline
Smile and the world smiles back
****
Equilibrium
Posts:
6,592
Threads:
97
Credibility:
000
Popularity:
422
βytes:
β 1,448
Game XP:
5,953
Jan 18, 2016 08:22 AM
Yes, something is wrong there

Please create a text file called fixlist.txt and copy/paste the contents in the code box below. (Do not include "Code:")

Code
CreateRestorePoint:
CloseProcesses:
Task: {F12CBD61-BEF6-4613-874D-E172D1BCAF67} - \DropboxUpdateTaskMachineCore -> No File <==== ATTENTION
Task: {F8D385BA-05F9-41B3-A7E4-A8C152C8B982} - \GoogleUpdateTaskMachineCore -> No File <==== ATTENTION
Task: {F9D87DFA-FF49-436D-8FC5-4E2D218291B6} - System32\Tasks\56504825 => C:\Program Files (x86)\cent\class.exe [2016-01-16] () <==== ATTENTION
Task: {FAC68BCD-C8A9-48DC-A15A-E0CAEFB385F4} - \Driver Booster Scan -> No File <==== ATTENTION
Task: {C38C2227-5CE7-40EF-AA1D-CEEE7CE5D9A8} - \DropboxUpdateTaskMachineUA -> No File <==== ATTENTION
Task: {DD3736DB-984C-477D-ADEE-EA5954970A42} - \GyazoUpdateTaskMachineDaily -> No File <==== ATTENTION
Task: {A99D729E-7849-455F-BEFE-A37025D030C8} - \Telerik Control Panel Notifier WIN-HBBVHMEMD8B_Jack -> No File <==== ATTENTION
Task: {8A92819F-7E4A-457C-8141-304CA005C76B} - System32\Tasks\281847184 => C:\Program Files (x86)\nutritious\raspy.exe [2016-01-16] (likeable) <==== ATTENTION
Task: {941B9E6E-F9E3-4261-B11B-A4FD12566AAA} - System32\Tasks\181847184 => C:\Program Files (x86)\nutritious\raspy.exe [2016-01-16] (likeable) <==== ATTENTION
Task: {97F1D027-DD57-475C-A908-757BB413ECC3} - System32\Tasks\667475153059593546 => C:\Program Files (x86)\teeth\zonked.exe [2016-01-16] (windows 99) <==== ATTENTION
Task: {712462BD-E97E-483A-9504-499B73BD65CA} - \[email protected] -> No File <==== ATTENTION
Task: {47B3A8DB-F5ED-4652-85C7-11ECCE1C07FD} - \Uninstaller_SkipUac_Jack -> No File <==== ATTENTION
Task: {6279A869-733B-41A9-ABE0-2D70F562EE03} - \{4C8A06ED-6224-4DA4-8310-1D67EF029021} -> No File <==== ATTENTION
Task: {627BBDBB-92AD-4699-A62A-9253D8DB93C8} - System32\Tasks\3146774314677431467743146774 => C:\Program Files (x86)\teeth\zonked.exe [2016-01-16] (windows 99) <==== ATTENTION
Task: {6DE30D67-5787-4466-96E0-719A62762E19} - \Driver Booster SkipUAC (Jack) -> No File <==== ATTENTION
Task: {1BF6104B-9A2F-4C75-AC2E-9A5DE3BE6727} - \Driver Booster Update -> No File <==== ATTENTION
Task: {0B89EC13-6CC0-43D1-8387-3500A9B59C90} - \GyazoUpdateTaskMachine -> No File <==== ATTENTION
Task: {18850801-F66F-477D-8097-23F5525B0334} - \GoogleUpdateTaskMachineUA -> No File <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-4270532649-2185237214-901248356-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 1 <======= ATTENTION (Restriction - ProxySettings)
ProxyEnable: [HKLM] => Proxy is enabled.
ProxyEnable: [HKLM-x32] => Proxy is enabled.
ProxyServer: [HKLM] => http=127.0.0.1:8877;https=127.0.0.1:8877
ProxyServer: [HKLM-x32] => http=127.0.0.1:8877;https=127.0.0.1:8877
AutoConfigURL: [HKLM] => http=127.0.0.1:8877;https=127.0.0.1:8877
ProxyEnable: [S-1-5-21-4270532649-2185237214-901248356-1001] => Proxy is enabled.
ProxyServer: [S-1-5-21-4270532649-2185237214-901248356-1001] => http=127.0.0.1:8877;https=127.0.0.1:8877
HKU\S-1-5-21-4270532649-2185237214-901248356-1001\...\MountPoints2: {d9693272-207f-11e5-b690-806e6f6e6963} - "E:\launch.bat"
HKLM\...\Run: [cutoauto] => C:\Program Files (x86)\teeth\industry.exe [42734 2016-01-16] ()
HKLM\...\Run: [interpee] => C:\Program Files (x86)\teeth\zonked.exe [37888 2016-01-16] (windows 99)
HKLM\...\Run: [autoauto] => C:\Program Files (x86)\teeth\zonked.exe [37888 2016-01-16] (windows 99)
HKLM-x32\...\Run: [cutoauto] => C:\Program Files (x86)\teeth\industry.exe [42734 2016-01-16] ()
HKLM-x32\...\Run: [interpee] => C:\Program Files (x86)\teeth\zonked.exe [37888 2016-01-16] (windows 99)
HKLM-x32\...\Run: [autoauto] => C:\Program Files (x86)\teeth\zonked.exe [37888 2016-01-16] (windows 99)
HKLM-x32\...\RunOnce: [usun.exe] => C:\Users\Jack\AppData\Local\SunnyDay5\usun.exe [3282096 2016-01-15] ()
HKLM\...\Policies\Explorer: [AllowLegacyWebView] 1
HKLM\...\Policies\Explorer: [AllowUnhashedWebView] 1
HKU\S-1-5-21-4270532649-2185237214-901248356-1001\...\Run: [rutoauto] => C:\Program Files (x86)\teeth\zonked.exe [37888 2016-01-16] (windows 99)
HKU\S-1-5-21-4270532649-2185237214-901248356-1001\...\Run: [dutoauto] => C:\Program Files (x86)\teeth\industry.exe [42734 2016-01-16] ()
HKU\S-1-5-21-4270532649-2185237214-901248356-1001\...\Run: [interpee] => C:\Program Files (x86)\teeth\zonked.exe [37888 2016-01-16] (windows 99)
EmptyTemp:

NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished, FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your next reply.
Sc00by
Sc00by Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,368
Threads:
116
Credibility:
1600
Popularity:
54
βytes:
β 0
Game XP:
0
Jan 18, 2016 08:37 AM
(Jan 18, 2016 08:22 AM)5chn4pp Wrote:  Yes, something is wrong there

Please create a text file called fixlist.txt and copy/paste the contents in the code box below. (Do not include "Code:")

Code
CreateRestorePoint:
CloseProcesses:
Task: {F12CBD61-BEF6-4613-874D-E172D1BCAF67} - \DropboxUpdateTaskMachineCore -> No File <==== ATTENTION
Task: {F8D385BA-05F9-41B3-A7E4-A8C152C8B982} - \GoogleUpdateTaskMachineCore -> No File <==== ATTENTION
Task: {F9D87DFA-FF49-436D-8FC5-4E2D218291B6} - System32\Tasks\56504825 => C:\Program Files (x86)\cent\class.exe [2016-01-16] () <==== ATTENTION
Task: {FAC68BCD-C8A9-48DC-A15A-E0CAEFB385F4} - \Driver Booster Scan -> No File <==== ATTENTION
Task: {C38C2227-5CE7-40EF-AA1D-CEEE7CE5D9A8} - \DropboxUpdateTaskMachineUA -> No File <==== ATTENTION
Task: {DD3736DB-984C-477D-ADEE-EA5954970A42} - \GyazoUpdateTaskMachineDaily -> No File <==== ATTENTION
Task: {A99D729E-7849-455F-BEFE-A37025D030C8} - \Telerik Control Panel Notifier WIN-HBBVHMEMD8B_Jack -> No File <==== ATTENTION
Task: {8A92819F-7E4A-457C-8141-304CA005C76B} - System32\Tasks\281847184 => C:\Program Files (x86)\nutritious\raspy.exe [2016-01-16] (likeable) <==== ATTENTION
Task: {941B9E6E-F9E3-4261-B11B-A4FD12566AAA} - System32\Tasks\181847184 => C:\Program Files (x86)\nutritious\raspy.exe [2016-01-16] (likeable) <==== ATTENTION
Task: {97F1D027-DD57-475C-A908-757BB413ECC3} - System32\Tasks\667475153059593546 => C:\Program Files (x86)\teeth\zonked.exe [2016-01-16] (windows 99) <==== ATTENTION
Task: {712462BD-E97E-483A-9504-499B73BD65CA} - \[email protected] -> No File <==== ATTENTION
Task: {47B3A8DB-F5ED-4652-85C7-11ECCE1C07FD} - \Uninstaller_SkipUac_Jack -> No File <==== ATTENTION
Task: {6279A869-733B-41A9-ABE0-2D70F562EE03} - \{4C8A06ED-6224-4DA4-8310-1D67EF029021} -> No File <==== ATTENTION
Task: {627BBDBB-92AD-4699-A62A-9253D8DB93C8} - System32\Tasks\3146774314677431467743146774 => C:\Program Files (x86)\teeth\zonked.exe [2016-01-16] (windows 99) <==== ATTENTION
Task: {6DE30D67-5787-4466-96E0-719A62762E19} - \Driver Booster SkipUAC (Jack) -> No File <==== ATTENTION
Task: {1BF6104B-9A2F-4C75-AC2E-9A5DE3BE6727} - \Driver Booster Update -> No File <==== ATTENTION
Task: {0B89EC13-6CC0-43D1-8387-3500A9B59C90} - \GyazoUpdateTaskMachine -> No File <==== ATTENTION
Task: {18850801-F66F-477D-8097-23F5525B0334} - \GoogleUpdateTaskMachineUA -> No File <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-4270532649-2185237214-901248356-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 1 <======= ATTENTION (Restriction - ProxySettings)
ProxyEnable: [HKLM] => Proxy is enabled.
ProxyEnable: [HKLM-x32] => Proxy is enabled.
ProxyServer: [HKLM] => http=127.0.0.1:8877;https=127.0.0.1:8877
ProxyServer: [HKLM-x32] => http=127.0.0.1:8877;https=127.0.0.1:8877
AutoConfigURL: [HKLM] => http=127.0.0.1:8877;https=127.0.0.1:8877
ProxyEnable: [S-1-5-21-4270532649-2185237214-901248356-1001] => Proxy is enabled.
ProxyServer: [S-1-5-21-4270532649-2185237214-901248356-1001] => http=127.0.0.1:8877;https=127.0.0.1:8877
HKU\S-1-5-21-4270532649-2185237214-901248356-1001\...\MountPoints2: {d9693272-207f-11e5-b690-806e6f6e6963} - "E:\launch.bat"
HKLM\...\Run: [cutoauto] => C:\Program Files (x86)\teeth\industry.exe [42734 2016-01-16] ()
HKLM\...\Run: [interpee] => C:\Program Files (x86)\teeth\zonked.exe [37888 2016-01-16] (windows 99)
HKLM\...\Run: [autoauto] => C:\Program Files (x86)\teeth\zonked.exe [37888 2016-01-16] (windows 99)
HKLM-x32\...\Run: [cutoauto] => C:\Program Files (x86)\teeth\industry.exe [42734 2016-01-16] ()
HKLM-x32\...\Run: [interpee] => C:\Program Files (x86)\teeth\zonked.exe [37888 2016-01-16] (windows 99)
HKLM-x32\...\Run: [autoauto] => C:\Program Files (x86)\teeth\zonked.exe [37888 2016-01-16] (windows 99)
HKLM-x32\...\RunOnce: [usun.exe] => C:\Users\Jack\AppData\Local\SunnyDay5\usun.exe [3282096 2016-01-15] ()
HKLM\...\Policies\Explorer: [AllowLegacyWebView] 1
HKLM\...\Policies\Explorer: [AllowUnhashedWebView] 1
HKU\S-1-5-21-4270532649-2185237214-901248356-1001\...\Run: [rutoauto] => C:\Program Files (x86)\teeth\zonked.exe [37888 2016-01-16] (windows 99)
HKU\S-1-5-21-4270532649-2185237214-901248356-1001\...\Run: [dutoauto] => C:\Program Files (x86)\teeth\industry.exe [42734 2016-01-16] ()
HKU\S-1-5-21-4270532649-2185237214-901248356-1001\...\Run: [interpee] => C:\Program Files (x86)\teeth\zonked.exe [37888 2016-01-16] (windows 99)
EmptyTemp:

NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished, FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your next reply.
http://pastebin.com/6yQ49Hp2
http://pastebin.com/dj2BLECg
5chn4pp
5chn4pp Offline
Smile and the world smiles back
****
Equilibrium
Posts:
6,592
Threads:
97
Credibility:
000
Popularity:
422
βytes:
β 1,448
Game XP:
5,953
Jan 18, 2016 08:38 AM
You need to click Fix instead of scan.
Sc00by
Sc00by Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,368
Threads:
116
Credibility:
1600
Popularity:
54
βytes:
β 0
Game XP:
0
Jan 18, 2016 08:57 AM
(Jan 18, 2016 08:38 AM)5chn4pp Wrote:  You need to click Fix instead of scan.

I did click Fix. It ran a process, closed everything, and then at the end restarted my computer.
5chn4pp
5chn4pp Offline
Smile and the world smiles back
****
Equilibrium
Posts:
6,592
Threads:
97
Credibility:
000
Popularity:
422
βytes:
β 1,448
Game XP:
5,953
Jan 18, 2016 08:59 AM
ok, please give the fixlog.txt that the program created.
Sc00by
Sc00by Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,368
Threads:
116
Credibility:
1600
Popularity:
54
βytes:
β 0
Game XP:
0
Jan 18, 2016 09:02 AM
(Jan 18, 2016 08:59 AM)5chn4pp Wrote:  ok, please give the fixlog.txt that the program created.

Oh crap, sorry. I misread your response earlier, I thought it created new versions of that file.

http://pastebin.com/L9DXU0jc
5chn4pp
5chn4pp Offline
Smile and the world smiles back
****
Equilibrium
Posts:
6,592
Threads:
97
Credibility:
000
Popularity:
422
βytes:
β 1,448
Game XP:
5,953
Jan 18, 2016 09:05 AM
Can malwarebytes install now?
Sc00by
Sc00by Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,368
Threads:
116
Credibility:
1600
Popularity:
54
βytes:
β 0
Game XP:
0
Jan 18, 2016 09:14 AM
No it cannot yet. I just tried a couple times.
5chn4pp
5chn4pp Offline
Smile and the world smiles back
****
Equilibrium
Posts:
6,592
Threads:
97
Credibility:
000
Popularity:
422
βytes:
β 1,448
Game XP:
5,953
Jan 18, 2016 09:16 AM
Its still there, i suspect a rat also.

Please post fresh FRST.txt and Addition.txt logs.
Sc00by
Sc00by Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,368
Threads:
116
Credibility:
1600
Popularity:
54
βytes:
β 0
Game XP:
0
Jan 18, 2016 09:17 AM
(Jan 18, 2016 09:16 AM)5chn4pp Wrote:  Its still there, i suspect a rat also.

Please post fresh FRST.txt and Addition.txt logs.

Is there a faster mode of contact I can reach you at?

I am not familiar with XMPP
5chn4pp
5chn4pp Offline
Smile and the world smiles back
****
Equilibrium
Posts:
6,592
Threads:
97
Credibility:
000
Popularity:
422
βytes:
β 1,448
Game XP:
5,953
Jan 18, 2016 09:19 AM
add live:pentester_10 on skype if my account still exists.

setting up xmpp is also very easy, you need 1 program and 10 minutes
Sc00by
Sc00by Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,368
Threads:
116
Credibility:
1600
Popularity:
54
βytes:
β 0
Game XP:
0
Jan 18, 2016 01:52 PM
(Jan 18, 2016 09:19 AM)5chn4pp Wrote:  add live:pentester_10 on skype if my account still exists.

setting up xmpp is also very easy, you need 1 program and 10 minutes

added you
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by Lit WhycakeMar 25, 2024 09:09 AM 4 212 Mar 25, 2024 09:09 AM
Last Post: Hackers
[Infected] by zograAug 20, 2020 02:30 PM 6 167 Aug 20, 2020 02:30 PM
Last Post: spyglass
by gas66Sep 11, 2016 06:23 AM 4 167 Sep 11, 2016 06:23 AM
Last Post: Rottapotta