[Eminem‎‏‍‎‏ ‎‏‍‎]

Basically I just want someone to check me over. Steam got stolen lsat night so ineeda make sure im not ratted. I sitll have his program but its isolated.

[Null Byte]

Welcome to the malware removal forum! My name is Null Byte and I will be assisting you today.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click FRST to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  


• Press Scan button.
  


• It will produce a log called FRST.txt in the same directory the tool is run from.
  


• Please copy and paste log to Pastebin.com and post the link here.
  


• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
  

From here on out please only take instructions from me.


Null Byte

[Eminem‎‏‍‎‏ ‎‏‍‎]

Welcome to the malware removal forum! My name is Null Byte and I will be assisting you today.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click FRST to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  


• Press Scan button.
  


• It will produce a log called FRST.txt in the same directory the tool is run from.
  


• Please copy and paste log to Pastebin.com and post the link here.
  


• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
  

From here on out please only take instructions from me.


Null Byte

http://pastebin.com/PYj642zQ

Thanks. First one is the regular scan second is the additional.

[obviouslyracist]

Wow so nice to see the Browser stealers they have been using for CS GO skins on a log.

How did you get it? Was it through TS3 or what?

By the way can you send me the link to it, please.

[Null Byte]

Download this file (Right click > Save Link as): http://a.pomf.se/rilgcq.txt
Save it to the same directory as FRST, make sure it's named fixlist.txt (VERY IMPORTANT). Open FRST and click the "Fix" button only once. When FRST is done fixing it will produce a log named fixlog.txt, post that here.

WARNING: Save ALL work before running this fixlist, as it will close all open programs and may reboot your computer!

[Eminem‎‏‍‎‏ ‎‏‍‎]

Download this file (Right click > Save Link as): http://a.pomf.se/rilgcq.txt
Save it to the same directory as FRST, make sure it's named fixlist.txt (VERY IMPORTANT). Open FRST and click the "Fix" button only once. When FRST is done fixing it will produce a log named fixlog.txt, post that here.

WARNING: Save ALL work before running this fixlist, as it will close all open programs and may reboot your computer!

Sorry for the delayed response was busy!

http://pastebin.com/JsBHkSLC

Sadly whatever that did just erased all my passwords etc..

[obviouslyracist]

Do you need them or are you able to recover them through Forgot Password for each website?
Your Firefox profile, where Firefox stores your bookmarks, passwords and other user data, was deleted because of a User.js.
A user.js file is an alternative method of modifying preferences(think of about:config). Because user.js doesn't exist by default, he assumed the browser stealer added that.
Wait for Null Byte to help you though since he is one the fixing your problem.
Just trying to inform you so you are not in the dark for too long.

[Knautschtabak]

Anything you remove with FRST can be restored again. I am sure Null Byte will take care of that.

[Tha Sneak]

Pointless scans. Please do the following:

Download OTL.exe by OldTimer to your Desktop.

• Close all windows and double click OTL.exe.
  


• Click Run Scan and let the program run uninterrupted.
  


• It will produce two logs for you, one will pop up - OTL.txt, the other will be saved on your Desktop - Extras.txt. Post both logs in this thread.
  


• You may need to use two posts to get it all.
  

[Eminem‎‏‍‎‏ ‎‏‍‎]

Download this file (Right click > Save Link as): http://a.pomf.se/rilgcq.txt
Save it to the same directory as FRST, make sure it's named fixlist.txt (VERY IMPORTANT). Open FRST and click the "Fix" button only once. When FRST is done fixing it will produce a log named fixlog.txt, post that here.

WARNING: Save ALL work before running this fixlist, as it will close all open programs and may reboot your computer!

Would you mind responding to my scan???

[Tha Sneak]

Perform the following fix with FRST.

• Save the following codes as FixList.txt using Notepad.exe. You are asked not to use any other text editing software. (Exclude the word Code)
  
  Code

  Start
RestoreQuarantine:
FF user.js: detected! => C:\Users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\j5sk7rnd.default\user.js [2014-05-16]
End


• Make sure that FRST.exe and FixList.txt are in the same folder.
  


• Re-run FRST.exe and click Fix.
  


• A log will open after the completion of the fix.
  


• Post the log in your reply.

[Eminem‎‏‍‎‏ ‎‏‍‎]

I'm just going to delete this thread, and make a new one. I have no idea who is really assisting me, and who isn't.