I'm making this thread for a friend, as his only solution to a potential virus is a reformat, and he refuses to go in this forum, because of them name... (he thinks he will get hacked)
So two days ago he was stupid enough to actually download a steam stealer, but luckily he got his items back, and formatted his pc.
The next day he received a facebook message from a stranger, telling him to go on a link. He followed the link, and realised that it was a scam, and closed the site without doing anything on it.
Today a lot of his passwords are changed.
What are the chances he is infected?
Could be good depending on the site he visited, it could have been a JDB.
Seems i'll have to do some cleanup then, could anyone guide me?
Can you PM me the link he clicked on, just to see if it was really infected with a JDB or other exploit ?
Fiat justitia ruat cælum
My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
Dec 8, 2014 07:06 AM
(This post was last modified: Dec 8, 2014 07:26 AM by TheDFighter.)
I would be happy to do so, but i'm not allowed to send pm's atm :/
EDIT: it seems that it was a file, and not a link. He just thought it was a link, since it opened a fake browser window disguised as a fake facebook. The file has been deleted, so i can't report it sorry :/
(Dec 8, 2014 07:06 AM)TheDFighter Wrote: I would be happy to do so, but i'm not allowed to send pm's atm :/
EDIT: it seems that it was a file, and not a link. He just thought it was a link, since it opened a fake browser window disguised as a fake facebook. The file has been deleted, so i can't report it sorry :/
He opened the file right ?
Well, it's hard to tell you friend what to do and ask for real-time report if he doesn't sign up here.
Fiat justitia ruat cælum
My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
Dec 9, 2014 02:47 AM
(This post was last modified: Dec 9, 2014 02:48 AM by TheDFighter.)
I decided to use Hyperions tutorial and the Tron script, that hyperion reviewed, on my friends pc, and he should be all clean now. It also seems he was using multiple antiviruses at once, because he thought more=better :x
(Dec 9, 2014 02:47 AM)TheDFighter Wrote: I decided to use Hyperions tutorial and the Tron script, that hyperion reviewed, on my friends pc, and he should be all clean now. It also seems he was using multiple antiviruses at once, because he thought more=better :x
Doesn't work that way.
Which Antivirus products does he have? I'll tell yoi which one he should keep.
Fiat justitia ruat cælum
My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
He had AVG, Norton and Kaspersky installed. Also some avast error popped up, from an unclean uninstall when we booted first time.
(Dec 9, 2014 06:42 AM)TheDFighter Wrote: He had AVG, Norton and Kaspersky installed. Also some avast error popped up, from an unclean uninstall when we booted first time.
If the Kaspersky licence is still active, uninstall AVG, Norton and avast! (If you don't see it installed, use its clean up tool). Start with that.
Fiat justitia ruat cælum
My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
Dec 9, 2014 06:57 AM
(This post was last modified: Dec 9, 2014 06:57 AM by TheDFighter.)
Okay, i removed everything but kaspersky now. There's still a trial license active for kaspersky.
(Dec 9, 2014 06:57 AM)TheDFighter Wrote: Okay, i removed everything but kaspersky now. There's still a trial license active for kaspersky.
Alright. Do you still get the avast! error pop-up on boot or not ?
Fiat justitia ruat cælum
My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
No, i don't get the error message anymore
(Dec 9, 2014 07:01 AM)TheDFighter Wrote: No, i don't get the error message anymore
While we're at it, can you tell your friend to follow the instructions here:
[BHCPU] Program/Software advices and recommendations Help Desk by Aurа
And post the URL to the Pastebin/Privatepaste paste here or there?
Fiat justitia ruat cælum
My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
Yeah i Can do that. I Will have to wait till tommorow though, as it's 10:30 pm here atm
|
