Spoof Call and Spoof SMS set any caller ◆ ProxiesFood: Unlimited Residential Proxy ◆ Cheap KYC Verifications & Openups ◆ Anvilpoint CyberOps - Hacker for Hire ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Whitehat • Blue Team • Defensive Security Malware, Rat, and Virus Removal › [Infected] Camera Light on for no Reason, Slow Performance and Weird Cursor

New Reply 
Infected 

Camera Light on for no Reason, Slow Performance and Weird Cursor
Effexion
Effexion Offline
That Guy with Spiders
*****
Benevolence
Posts:
18,409
Threads:
2,625
Credibility:
5600
Popularity:
755
βytes:
β 137
Game XP:
925
Sep 4, 2017 01:58 PM
Looks like that despite all my best intentions, I have a RAT. Can someone please do a checkup for me?
Resident Writer for MyGamer.Com and Horrify.Net
FatStacks
FatStacks Offline
Exchanging for cashapp!
***
HF l33t
Posts:
1,014
Threads:
136
Credibility:
400
Popularity:
-2
βytes:
β 0
Game XP:
0
Sep 4, 2017 02:18 PM
(Sep 4, 2017 01:58 PM)Effexion Wrote:  Looks like that despite all my best intentions, I have a RAT. Can someone please do a checkup for me?

Back up all current files to a external harddrive then use a data des on your main/os hard drive then reinstall windows
Effexion
Effexion Offline
That Guy with Spiders
*****
Benevolence
Posts:
18,409
Threads:
2,625
Credibility:
5600
Popularity:
755
βytes:
β 137
Game XP:
925
Sep 4, 2017 02:25 PM
(Sep 4, 2017 02:18 PM)FatStacks Wrote:  Back up all current files to a external harddrive then use a data des on your main/os hard drive then reinstall windows

I feel backing up all my files won't solve the problem. I haven't opened anything over suspicious, so the chances are that I will click whatever it is again.
Resident Writer for MyGamer.Com and Horrify.Net
camden ™
camden ™ Away
[closed@HF:]
Posts:
53
Threads:
9
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 4, 2017 02:28 PM
My camera light shows up sometimes, but I am not ratted.
I'd recommend you download Wireshark and search for DNS before you reset anything.
Good luck.
Death
Death Away
[gawd@HF:]
***
HF l33t
Posts:
971
Threads:
55
Credibility:
1200
Popularity:
261
βytes:
β 7,051.21
Game XP:
4,372
Sep 4, 2017 02:29 PM
Does anyone have your wifi password?
What system are you running?
[Image: QVTgPo7.gif]
Not Your Average Orange
Not Your Average Orange Offline
[closed@HF:]
Posts:
1,314
Threads:
108
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 4, 2017 02:29 PM
Download Farbar Recovery Scan tool
Run as admin >
Yes to disclaimer >
Scan >
Put logs in pastebin, they will be in the same dir as FRST >
Post here
Effexion
Effexion Offline
That Guy with Spiders
*****
Benevolence
Posts:
18,409
Threads:
2,625
Credibility:
5600
Popularity:
755
βytes:
β 137
Game XP:
925
Sep 4, 2017 02:29 PM (This post was last modified: Sep 4, 2017 02:29 PM by Effexion.)
(Sep 4, 2017 02:28 PM)camden ™ Wrote:  My camera light shows up sometimes, but I am not ratted.
I'd recommend you download Wireshark and search for DNS before you reset anything.
Good luck.


Why would the camera light just come on for no reason? You might want to make a thread too, amigo.

It's not just that, my cursor is fucky as fuckery too.

(Sep 4, 2017 02:29 PM)Not Your Average Orange Wrote:  Download Farbar Recovery Scan tool
Run as admin >
Yes to disclaimer >
Scan >
Put logs in pastebin, they will be in the same dir as FRST >
Post here

Thanks, doing this now.
Resident Writer for MyGamer.Com and Horrify.Net
camden ™
camden ™ Away
[closed@HF:]
Posts:
53
Threads:
9
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 4, 2017 02:30 PM
(Sep 4, 2017 02:29 PM)Effexion Wrote:  Why would the camera light just come on for no reason? You might want to make a thread too, amigo.

It's not just that, my cursor is fucky as fuckery too.

I'm not sure it was a few months ago, i'm sure I wasn't ratted. But I'd really recommend using Wireshark.
Death
Death Away
[gawd@HF:]
***
HF l33t
Posts:
971
Threads:
55
Credibility:
1200
Popularity:
261
βytes:
β 7,051.21
Game XP:
4,372
Sep 4, 2017 02:35 PM
Nibba didnt even answer my questions.
ok.
[Image: QVTgPo7.gif]
Effexion
Effexion Offline
That Guy with Spiders
*****
Benevolence
Posts:
18,409
Threads:
2,625
Credibility:
5600
Popularity:
755
βytes:
β 137
Game XP:
925
Sep 4, 2017 03:06 PM
FRST.txt: https://pastebin.com/Xe9RD3Y9
Addition.txt: https://pastebin.com/7ZyWrXT2

Thank you!
Resident Writer for MyGamer.Com and Horrify.Net
Death
Death Away
[gawd@HF:]
***
HF l33t
Posts:
971
Threads:
55
Credibility:
1200
Popularity:
261
βytes:
β 7,051.21
Game XP:
4,372
Sep 4, 2017 03:18 PM (This post was last modified: Sep 4, 2017 03:21 PM by Death.)
I can see that mousepoints 2

What is the installer.exe on D:
[Image: QVTgPo7.gif]
Flaws.
Flaws. Offline
Arte et Marte
**********
The Brotherhood
Posts:
2,101
Threads:
54
Credibility:
400
Popularity:
525
βytes:
β 27.73
Game XP:
0
Sep 4, 2017 03:29 PM
Just from a quick read I can see

HKU\S-1-5-21-3820243653-2334247829-3564828230-1001\...\MountPoints2: {3d6e705a-5c6c-11e7-b9e2-806e6f6e6963} - "D:\Installer.exe"

which is uh about as sketchy as it gets not gonna lie
evening chaps
QQ Spitfire
QQ Spitfire Offline
[n00b@HF:]
*
Registered
Posts:
36
Threads:
2
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Sep 4, 2017 03:32 PM
Might be worth you checking the following...

Processors Under task manger
Wireshark checking dodgy connections
Virus/Malware Scan

That should give an outcome to what's going on. If not just backup your files and do a fresh install, if your on Windows 10 there's an option to create a clean install of the OS but keep your files.

Hope this helped!
Effexion
Effexion Offline
That Guy with Spiders
*****
Benevolence
Posts:
18,409
Threads:
2,625
Credibility:
5600
Popularity:
755
βytes:
β 137
Game XP:
925
Sep 4, 2017 04:00 PM (This post was last modified: Sep 4, 2017 04:01 PM by Effexion.)
(Sep 4, 2017 03:18 PM)Death Wrote:  I can see that mousepoints 2

What is the installer.exe on D:

(Sep 4, 2017 03:29 PM)Flaws. Wrote:  Just from a quick read I can see

HKU\S-1-5-21-3820243653-2334247829-3564828230-1001\...\MountPoints2: {3d6e705a-5c6c-11e7-b9e2-806e6f6e6963} - "D:\Installer.exe"

which is uh about as sketchy as it gets not gonna lie

I never use D:/, that's suss as fuck lol. Any way of telling what installed installer.exe because there's no way I would have opened that.

(Sep 4, 2017 03:32 PM)QQ Spitfire Wrote:  Might be worth you checking the following...

Processors Under task manger
Wireshark checking dodgy connections
Virus/Malware Scan

That should give an outcome to what's going on. If not just backup your files and do a fresh install, if your on Windows 10 there's an option to create a clean install of the OS but keep your files.

Hope this helped!

I don't want to do a fresh install really as like I said earlier, I would probably end up opening it again because there's nothing I can think i have clicked that would have put that there.

EDIT: I'm such a noob. D:/ is my disk drive and it's WoW lol.
Resident Writer for MyGamer.Com and Horrify.Net
Not Your Average Orange
Not Your Average Orange Offline
[closed@HF:]
Posts:
1,314
Threads:
108
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 4, 2017 04:19 PM (This post was last modified: Sep 4, 2017 04:19 PM by Not Your Average Orange.)
I couldn't find anything in the FRST logs, but I'm still new to this.
If you're still concerned, try downloading GlassWire, and observing internet connections.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by Michelangelo TMNTDec 27, 2018 08:09 PM 9 300 Dec 27, 2018 08:09 PM
Last Post: Nyx
[Check-Up] by EffexionAug 30, 2017 11:42 PM 3 171 Aug 30, 2017 11:42 PM
Last Post: lmorra
by DOZ1TJan 5, 2017 02:55 PM 7 213 Jan 5, 2017 02:55 PM
Last Post: JoshuTee