ProxiesFood: Unlimited Residential Proxy ◆ Anvilpoint CyberOps - Hacker for Hire ◆ Spoof Call and Spoof SMS set any caller ◆ Cheap KYC Verifications & Openups ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Whitehat • Blue Team • Defensive Security Malware, Rat, and Virus Removal › [Infected] Weird Virus (virus.neshta) [STILL NEED HELP!!!]

New Reply 
Infected 

Weird Virus (virus.neshta) [STILL NEED HELP!!!]
Xogg
Xogg Offline
Check out the Delphi section
***
HF l33t
Posts:
919
Threads:
164
Credibility:
200
Popularity:
82
βytes:
β 2.5
Game XP:
5
May 7, 2017 09:47 AM (This post was last modified: May 7, 2017 04:24 PM by Xogg.)
So i got this virus and its doing a few things, one when I try to open for example: Notepad++ its prompting saying to run in svchost.com. If i click yes sometimes it will open and other times it will open the wizard which asks me to chose what to run it in. This has resulted to me not being able to open 95% of the things on my pc. Here are a few

-Google Chrome
-Internet Explorer
-Mozila Firefox
-Explorer.exe
-CMD

I have bypassed this for some programs by for example opening: Explorer.exe in Explorer.exe so opening the program that wont open in itself, (If that makes any since)

My pc is currently on and in safe mode with networking, this allowed me to open and use google chrome. But still is prompting with svchost.com

I used malwareBytes to do a FULL scan yesterday and here is the main detection I kept getting.
[Image: .eJwFwdsNwyAMAMBdGADzsAtkG0QQiZpgBI76UXX...height=219]
The "Type" is virus.neshta


If you cant read the image here is a direct link
Spoiler (Click to View)

Also in the image it gives a directory in where the virus is, I DID delete the whole directory of where it was all occurring.


EDIT: So i did scans using RKILL64 and ADWcleaner but i was in safe mode on my PC I restarted my PC and redid them and got differnt results logs soon!


LOGS


ADWcleaner
Spoiler (Click to View)

RKILL64
Spoiler (Click to View)


Farbar Recovery Scan Tool
Spoiler (Click to View)
[Image: F2G97kn.png]
Rexethic
Rexethic Offline
[closed@HF:]
Posts:
55
Threads:
4
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
May 7, 2017 09:52 AM
Seems like adware, with bunch of popups and injected into svhost.
Try MalwareBytes Anti-Malware.
Xogg
Xogg Offline
Check out the Delphi section
***
HF l33t
Posts:
919
Threads:
164
Credibility:
200
Popularity:
82
βytes:
β 2.5
Game XP:
5
May 7, 2017 09:54 AM
(May 7, 2017 09:52 AM)Rexethic Wrote:  Seems like adware, with bunch of popups and injected into svhost.
Try MalwareBytes Anti-Malware.

Is this the same as the regular MalwareBytes or a different program, I already scanned in malwareBytes
[Image: F2G97kn.png]
DelziumTheProudWhale_temp
DelziumTheProudWhale_temp Offline
[closed@HF:]
Posts:
1,166
Threads:
80
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
May 7, 2017 10:01 AM
scan your pc with eset antivirus
KyFu
KyFu Away
I'ₘ Yₒᵤᵣ Gᵢᵣₗ'ₛ Cₕₑf.
***
HF Ub3r
Posts:
1,368
Threads:
176
Credibility:
000
Popularity:
107
βytes:
β 169
Game XP:
99
May 7, 2017 10:03 AM
Use Adwcleaner by Malwarebytes. [FREE]
Panda Cloud Cleaner is also a very good program to use. [Takes awhile on full scan, but accurate.] [FREE]
He Who Fights By The Sword, Also Dies By It Too.
Xogg
Xogg Offline
Check out the Delphi section
***
HF l33t
Posts:
919
Threads:
164
Credibility:
200
Popularity:
82
βytes:
β 2.5
Game XP:
5
May 7, 2017 10:04 AM
(May 7, 2017 10:03 AM)KyFu Wrote:  Use Adwcleaner by Malwarebytes. [FREE]
Panda Cloud Cleaner is also a very good program to use. [Takes awhile on full scan, but accurate.] [FREE]

I will give these both a go.
[Image: F2G97kn.png]
5chn4pp
5chn4pp Offline
Smile and the world smiles back
****
Equilibrium
Posts:
6,592
Threads:
97
Credibility:
000
Popularity:
422
βytes:
β 1,448
Game XP:
5,953
May 7, 2017 10:32 AM (This post was last modified: May 7, 2017 10:45 AM by 5chn4pp.)
Only FRST can remove viruses such as this, virus.neshta is like a ramnit infection, its severe and no antimalware tool expect for FRST and similar will remove it.

EDIT: It's also known as "Predator logger" which is a RAT, so please change your passwords.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Right click to run as administrator. When the tool opens click Yes to disclaimer.

  • Press Scan button.

  • It will produce logs called FRST.txt and Addition.txt in the same directory the tool is run from.

  • Please copy and paste the logs back here.


Xogg
Xogg Offline
Check out the Delphi section
***
HF l33t
Posts:
919
Threads:
164
Credibility:
200
Popularity:
82
βytes:
β 2.5
Game XP:
5
May 7, 2017 03:43 PM
(May 7, 2017 10:32 AM)5chn4pp Wrote:  Only FRST can remove viruses such as this, virus.neshta is like a ramnit infection, its severe and no antimalware tool expect for FRST and similar will remove it.

EDIT: It's also known as "Predator logger" which is a RAT, so please change your passwords.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Right click to run as administrator. When the tool opens click Yes to disclaimer.

  • Press Scan button.

  • It will produce logs called FRST.txt and Addition.txt in the same directory the tool is run from.

  • Please copy and paste the logs back here.



Thanks for the help working on c=scanning now.
[Image: F2G97kn.png]
Mr. Kim
Mr. Kim Offline
Talk shit get nuked.
***
HF l33t
Posts:
1,071
Threads:
29
Credibility:
000
Popularity:
14
βytes:
β 0
Game XP:
0
May 7, 2017 05:17 PM (This post was last modified: May 7, 2017 05:20 PM by Mr. Kim.)
If it's still happening in safemode you have a bad situation friend. The malware is running from kernel space. The malware has the same integrity as the OS itself. I would use a rescue disk.

One from Kaspersky

One from Comodo

One from Avast

I can promise you it will not be removed if you boot to your current OS. If it looks like it's gone, it's just hiding.
Selling signature space - PM if interested


hi mr fbi
5chn4pp
5chn4pp Offline
Smile and the world smiles back
****
Equilibrium
Posts:
6,592
Threads:
97
Credibility:
000
Popularity:
422
βytes:
β 1,448
Game XP:
5,953
May 7, 2017 11:13 PM (This post was last modified: May 8, 2017 12:03 AM by 5chn4pp.)
(May 7, 2017 05:17 PM)Mr. Kim Wrote:  I can promise you it will not be removed if you boot to your current OS.

Spoiler (Click to View)

You can remove it in normal mode if you want to, the only requirement is will power.

Download fixlist.txt file and save it to the Desktop.

NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
Brainsdotco
Brainsdotco Offline
[n00b@HF:]
*
Registered
Posts:
26
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
May 8, 2018 04:53 PM
Aw dude you are formed, this is one pickle
ltpg2010
ltpg2010 Offline
[n00b@HF:]
*
Registered
Posts:
3
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 8, 2018 07:22 AM
lets hope and see what happens
VENI
VENI Offline
Seller
**
HF l33t
Posts:
146
Threads:
43
Credibility:
200
Popularity:
45
βytes:
β 622.37
Game XP:
0
Jul 15, 2018 05:15 AM
(May 7, 2017 09:47 AM)Xogg Wrote:  So i got this virus and its doing a few things, one when I try to open for example: Notepad++ its prompting saying to run in svchost.com. If i click yes sometimes it will open and other times it will open the wizard which asks me to chose what to run it in. This has resulted to me not being able to open 95% of the things on my pc. Here are a few

-Google Chrome
-Internet Explorer
-Mozila Firefox
-Explorer.exe
-CMD

I have bypassed this for some programs by for example opening: Explorer.exe in Explorer.exe so opening the program that wont open in itself, (If that makes any since)

My pc is currently on and in safe mode with networking, this allowed me to open and use google chrome. But still is prompting with svchost.com

I used malwareBytes to do a FULL scan yesterday and here is the main detection I kept getting.
[Image: .eJwFwdsNwyAMAMBdGADzsAtkG0QQiZpgBI76UXX...height=219]
The "Type" is virus.neshta


If you cant read the image here is a direct link
Spoiler (Click to View)

Also in the image it gives a directory in where the virus is, I DID delete the whole directory of where it was all occurring.


EDIT: So i did scans using RKILL64 and ADWcleaner but i was in safe mode on my PC I restarted my PC and redid them and got differnt results logs soon!


LOGS


ADWcleaner
Spoiler (Click to View)

RKILL64
Spoiler (Click to View)


Farbar Recovery Scan Tool
Spoiler (Click to View)

Use HitmanPro it is the best scanner. https://www.hitmanpro.com/en-us.aspx
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by rayko0 ExpertMay 31, 2017 01:28 PM 8 718 May 31, 2017 01:28 PM
Last Post: rayko0 Expert
by Quest™Nov 14, 2012 09:04 PM 3 170 Nov 14, 2012 09:04 PM
Last Post: Wafflemonger
by ExcoreSep 8, 2012 08:32 PM 14 398 Sep 8, 2012 08:32 PM
Last Post: Retribute