[drgnmstriw]

Hi all, my friend recommended me to this forum for help with my problem.

Basically to make a long story short, I clicked on a link that I wasnt supposed to (didnt download anything, just opened the l link). Later on, after I logged into my email, the hacker sent me pics logged into my email. I tried changing my passwords but he kept changing them back. I was finally able to recover my emails on a separate computer, but my main computer is still infected.

I ran malwarebytes and other programs but they didn't find anything. I finally downloaded spybot and it actually found something. I can't take a picture from my other computer, but this is a general description of what it shows as the infected files:

---------------------

Problem:
CouponBar

Kind:
12 entires Adware-000

Descriptions:
HKEY_CLASSES_ROOT\CLSID\(9522...... [a lot of numbers here] )
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cprbkpie.Coupon6Ctrl.1
[10 more files listed]
-----------------------

Spybot was able to remove almost all of them, but it wouldn't allow me to remove the last 2 because "the associated files are still in use (in memory). This could be fixed with a restart".

I restarted my computer and it is currently going through another scan.

Other than this, is there anyway to definitely know if the keylogger/rat is still on my computer? Do you think these files were involved with the keylogger?

Thanks for the help in advance!

[Resilience]

From what I can see, spybot found some Adware. It must not be related to the RAT or Keylogger. I'll give you two options

First:
1. Go into safe mode with networking
2. Download and run RKILL
3. Run Malwarebytes

Second:
And it might be the better option if the first one didn't work
Reinstall windows

[drgnmstriw]

From what I can see, spybot found some Adware. It must not be related to the RAT or Keylogger. I'll give you two options

First:
1. Go into safe mode with networking
2. Download and run RKILL
3. Run Malwarebytes

Second:
And it might be the better option if the first one didn't work
Reinstall windows

I tried Rkill and malwarebytes and they didn't pick up the keylogger. Malware bytes picked up pop up ads but that's about it.

Any other suggestions?

[licker98]

I tried Rkill and malwarebytes and they didn't pick up the keylogger. Malware bytes picked up pop up ads but that's about it.

Any other suggestions?

Try Hitman Pro. Also try ESET.

[drgnmstriw]

Try Hitman Pro. Also try ESET.

Hitman pro didn't find anything either.

Is there a free version of ESET? The version I found wanted me to enter my home address, phone, full name, etc.

[CryptixHacking]

You could use a simple firewall type program that scans and detects when a programs attempts to make a socket based connection to a remote server online.

If it is a RAT/Trojan/Botnet/Keylogger then it has to connect to a server somewhere for control or data gathering. So from there you could block the application from connection and then remove it. Or even view the server end IP-Port and block or re-route that from your localhost.

If on windows tinywall is pretty good for just that

https://tinywall.pados.hu

Its GUI lets you easily set it up so anytime a program or service attempts to connect to a remote server you can view the program doing it, Its location and where its connecting to and if you want to block or allow it. Now yes most AV will have firewalls within them too but they wont automatically block all client based services like tinywall can.

[drgnmstriw]

You could use a simple firewall type program that scans and detects when a programs attempts to make a socket based connection to a remote server online.

If it is a RAT/Trojan/Botnet/Keylogger then it has to connect to a server somewhere for control or data gathering. So from there you could block the application from connection and then remove it. Or even view the server end IP-Port and block or re-route that from your localhost.

If on windows tinywall is pretty good for just that



Its GUI lets you easily set it up so anytime a program or service attempts to connect to a remote server you can view the program doing it, Its location and where its connecting to and if you want to block or allow it. Now yes most AV will have firewalls within them too but they wont automatically block all client based services like tinywall can.

Thank you very much! I'll definitely try this when I get home.

I tried looking at a list of established networking using command prompt with the netstat -ano command over the course of a few days to see if anything was different. One day I noticed a bunch of established networks with different IP's from google chrome, although I only had 2 chrome windows open at the time. I wasn't sure if this was usual or suspicious. All of the established networks had the same PIN (to google chrome), but there were about 15-20 different foreign IP's attached to them. I'll have to check the netstat -ano command again when I get home to see if anything has changed.

[PirateGoyim]

Most anti viruses can easily detect Keyloggers and R.a.ts at no problem. I would recommend using Malwarebytes. If that doesn't work look for any suspicious files on the startup menu on Task Manager. Or see anything running on task manager that is suspicous. If that doesn't work I don't know much would. I think if you check what is is pinging our connecting on cmd might work. It might give you the IP of the hacker and you could block it uses your vpn. Or ddosing him for revenge haha

[GruntStyl]

NoBot will detect the vast majority of Keyloggers/RATs. Especially those that are used commonly amongst this forum.

[M O D E R N]

1st make sure you unplug your computer from the internet. Then unplug everything else, go to the highest rooftop you can find and just throw your computer. Once the computer hits the ground make sure you check and see if you can find all the pieces. Collect all of the pieces you can find, start a fire and then just burn them.

Once the computer is melted or destroyed as much as it possibly can, go on the internet from another computer that is clean and order yourself a new one.

If you don't feel like going through all of that I would say do the following:
1. Disconnect from the internet
2. Run Rkill and also might want to run autoruns (https://technet.microsoft.com/en-us/sysi...63902.aspx)
3. Restart in safemode run Malwarebytes, Mbar and JRT
4. Reboot, run malwarebytes again (still disconnected from the internet) depending on how it looks from there you will have to decide the next step.

You may want to also make sure to check your AppData folders to see if there is anything weird there (hidden)

I would also recommend running ccleaner and checking your startup items.

[drgnmstriw]

NoBot will detect the vast majority of Keyloggers/RATs. Especially those that are used commonly amongst this forum.

that would be perfect, is nobot free to download?

---

1st make sure you unplug your computer from the internet. Then unplug everything else, go to the highest rooftop you can find and just throw your computer. Once the computer hits the ground make sure you check and see if you can find all the pieces. Collect all of the pieces you can find, start a fire and then just burn them.

Once the computer is melted or destroyed as much as it possibly can, go on the internet from another computer that is clean and order yourself a new one.

If you don't feel like going through all of that I would say do the following:
1. Disconnect from the internet
2. Run Rkill and also might want to run autoruns
3. Restart in safemode run Malwarebytes, Mbar and JRT
4. Reboot, run malwarebytes again (still disconnected from the internet) depending on how it looks from there you will have to decide the next step.

You may want to also make sure to check your AppData folders to see if there is anything weird there (hidden)

I would also recommend running ccleaner and checking your startup items.

For some reason my internet isn't working in safe mode with networking. Should I just use my computer in regular safe mode to run the scans?

[M O D E R N]

that would be perfect, is nobot free to download?

---

For some reason my internet isn't working in safe mode with networking. Should I just use my computer in regular safe mode to run the scans?

Yes if that is your only option. This may be a stupid question but how did you disconnect from the internet to begin with?

[hazez0r]

Disconnect your internet asap, save your important stuff and formate. Thats what I would have done atleast. There is a few removal tools you can find tho. Hope that one you just was about to try will work dude. Otherwise just formate.

[tuNNelZ]

Do a disk recovery before the issue occured, get 25 HQ Post and PM me for more help.

[drgnmstriw]

Yes if that is your only option. This may be a stupid question but how did you disconnect from the internet to begin with?

I'm not sure tbh. My internet works fine, but when I'm in safemode with networking I can't access the internet. Someone told me it was because windows 10 doesn't allow wireless networks to operate in safemode anymore, but I don't know is that is true.