[keemodas]

I infect myself with a keylogger please advice on what do in the future below is the FRST and ADDITION

https://pastebin.com/j2XAXaJe

[AsSaSs@iN]

Hey,

I'm AsSaSs@iN, I'm a member of the HackForums Malware Removal Team (MRT) and will be assisting you throughout this thread. Before we start just take a second to read through these few requests - these are to ensure we can help you quickly and safely:

• Only use this thread for help. Please don't create multiple threads, accounts, PM me or post on other forums - if you do just let me know.
  


• Only follow my guidance.
  


• Don't run tools I haven't asked you to run. If you do just let me know so I can take that into consideration when viewing logs.
  


• DO NOT install any other software while we are attempting to clean your machine. It can get quite confusing especially if you are downloading questionable tools.
  


• Please be prompt in responding. I'll do my best to do so. If >48hrs has passed, please either PM me or ask "Are you there, I still need help" in this thread.
  


• Please stick with me until I give you the 'All Clean'. I'll help you cleanup quickly and offer some tips to make you more secure and get your system running faster.
  


• Your malware related tools will be removed. I don't support the tools often distributed on these forums. Scanners will generally remove these - I take no responsibility for any malicious software that is lost.
  


• I (nor does the forum) support pirated software.
  


• If you don't understand something, don't be afraid to ask - I'm here to help. 😉
  

Farbar Recovery Scan Tool (FRST) - Fix

Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Open Notepad and copy/paste the following into notepad:
  
  
  
  CloseProcesses:
  CreateRestorePoint:
  C:\Users\Hakeem\AppData\Roaming\euro_stub.exe
  HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\Run: [Windows 10 Update] => C:\Users\Hakeem\AppData\Roaming\euro_stub.exe [79872 2017-12-18] (Microsoft @ 2015)
  C:\Users\Hakeem\AppData\Roaming\dhl_tracking.exe
  C:\Users\Hakeem\AppData\Roaming\eeSQOM64aK.exe
  C:\Users\Hakeem\Desktop\receipt of transfer.exe
  C:\Users\Hakeem\Desktop\receipt of transfer.zip
  C:\Users\Hakeem\AppData\Roaming\TMP_4728
  C:\Users\Hakeem\AppData\Roaming\swift_remittance.exe
  C:\Users\Hakeem\Documents\stub_orion.exe
  C:\Users\Hakeem\AppData\Roaming\ranger.browserlogging.vault.dll
  C:\Users\Hakeem\AppData\Roaming\Ranger.BrowserLogging.dll
  C:\Users\Hakeem\Documents\TMP_4728
  C:\Users\Hakeem\AppData\Roaming\dhl_tracking.exe
  C:\Users\Hakeem\AppData\Roaming\eeA86qomIo.exe
  C:\Users\Hakeem\AppData\Roaming\eeSQOM64aK.exe
  C:\Users\Hakeem\AppData\Roaming\euro_stub.exe
  C:\Users\Hakeem\AppData\Roaming\Ranger.BrowserLogging.dll
  C:\Users\Hakeem\AppData\Roaming\ranger.browserlogging.vault.dll
  C:\Users\Hakeem\AppData\Roaming\swift_remittance.exe
  C:\Users\Hakeem\AppData\Roaming\TMP_4728
  C:\Users\Hakeem\AppData\Local\CSIDL_
  C:\Users\Hakeem\AppData\Local\PUTTY.RND
  C:\Users\Hakeem\AppData\Local\Temp\awmoo.exe
  C:\Users\Hakeem\AppData\Local\Temp\bfsvc.exe
  C:\Users\Hakeem\AppData\Local\Temp\cdo2249078341.dll
  C:\Users\Hakeem\AppData\Local\Temp\ciagi.exe
  C:\Users\Hakeem\AppData\Local\Temp\ckewe.exe
  C:\Users\Hakeem\AppData\Local\Temp\csoge.exe
  C:\Users\Hakeem\AppData\Local\Temp\dllnt_dump.dll
  C:\Users\Hakeem\AppData\Local\Temp\iooqi.exe
  C:\Users\Hakeem\AppData\Local\Temp\qgyuu.exe
  C:\Users\Hakeem\AppData\Local\Temp\Ranger.BrowserLogging.dll
  C:\Users\Hakeem\AppData\Local\Temp\ranger.browserlogging.vault.dll
  C:\Users\Hakeem\AppData\Local\Temp\rhfft.exe
  C:\Users\Hakeem\AppData\Local\Temp\sggqg.exe
  C:\Users\Hakeem\AppData\Local\Temp\uoqum.exe
  C:\Users\Hakeem\AppData\Local\Temp\zphfv.exe
  C:\Users\Hakeem\AppData\Local\Temp\{0CDFA6E4-2973-4A2A-B1CB-6CB713C48180}-62.0.3202.89_61.0.3163.100_chrome_updater.exe
  EmptyTemp:
  
  
  
  
  


• Save the file as fixlist.txt, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located)
  


• Right-click on the FRST executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  


• Click on the Fix button
  
  
  
  


• On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad
  


• Copy and paste its content in your next reply
  

~~~

I see you have malwarebytes and RogueKiller installed. Please update both of these and run full scans, remove what is found. I will need to see the logs.


In your next reply:

• Log from FRST
  


• Log from Malwarebytes
  


• Log from RogueKiller
  


• How are things running?
  


• Fresh log from FRST
  

[keemodas]

This is Fix Log information below:

https://pastebin.com/YupgvNt1

[device]

Hey,

I'm AsSaSs@iN, I'm a member of the HackForums Malware Removal Team (MRT)  

You should legit listen to AsSaSs@iN.

[AsSaSs@iN]

This is Fix Log information below:

https://pastebin.com/YupgvNt1

Hey, that is a new log. You need to run the fix like in my instructions. Please follow each step carefully and post the logs required.

[keemodas]

sorry ....

https://pastebin.com/a89KXhhs

[Elitas]

Would also recommend downloading KeyScrambler. It doesn't removed the keylogger, but it will certainly protect you from getting keylogged if it can't be removed and in the future.

[AsSaSs@iN]

sorry ....

https://pastebin.com/a89KXhhs

great, please follow the rest of my post 🙂 update rogue killer and Malwarebytes and perform a full scan and remove anything found.

[Ranger.]

C:\Users\Hakeem\AppData\Roaming\ranger.browserlogging.vault.dll
C:\Users\Hakeem\AppData\Roaming\Ranger.BrowserLogging.dll

@OP: Just a question, where did you get this from?