DO NOT DEAL WITH THIS MEMBER
FRST: https://pastebin.com/Bf2EtrZJ
Addition: https://pastebin.com/NTkM4ZVP
The screen flashes some times, keys get fucked up for some reason and starts opening programs instead of doing what they should.
You have a rat, and there is a driver issue with your mouse and keyboard.
Download fixlist.txt file and save it to the Desktop.
NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
DO NOT DEAL WITH THIS MEMBER
Jul 19, 2017 09:08 AM
(This post was last modified: Jul 19, 2017 09:08 AM by Dopeish.)
(Jul 19, 2017 09:02 AM)5chn4pp Wrote: You have a rat, and there is a driver issue with your mouse and keyboard.
Download fixlist.txt file and save it to the Desktop.
NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
https://pastebin.com/BGdneL8D
The dlihost was my own rat I tested just to see if it were working some time ago, I'm pretty sure of.
There was also another rat, please upload this folder to https://share.riseup.net/ and post the link here:
C:\Users\granz\Desktop\19.07.2017_18.05.21.zip
----------
Please download RogueKiller and save it to your desktop. - Quit all running programs.
- Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
- Read and accept the EULA (End User License Agreement)
- Click Scan to scan the system.
- When the scan completes select "Report", a log will open. Close the program > Don't Fix anything!
- Post the contents of the log in your next reply.
DO NOT DEAL WITH THIS MEMBER
These files are password stealers and a bitcoin stealer, I recommend you change all of your passwords.
Now to the driver, please open device manager and post a screenshot of the drivers.
DO NOT DEAL WITH THIS MEMBER
(Jul 19, 2017 10:43 AM)5chn4pp Wrote: These files are password stealers and a bitcoin stealer, I recommend you change all of your passwords.
Now to the driver, please open device manager and post a screenshot of the drivers. Are they gone now?
https://i.imgur.com/1VW2BCo.png
Yeah I deleted it, do you see a "Trusted Platform Module 2.0" device in device manager? Try to enable it.
DO NOT DEAL WITH THIS MEMBER
(Jul 19, 2017 06:54 PM)5chn4pp Wrote: Yeah I deleted it, do you see a "Trusted Platform Module 2.0" device in device manager? Try to enable it.
Can't find.
(Jul 19, 2017 07:25 PM)Dopeish Wrote: Can't find.
Then its fine, the malware is gone and that driver wont be important if its not in device manager, if you have any questions please ask, otherwise have a great day 🤝
DO NOT DEAL WITH THIS MEMBER
(Jul 19, 2017 07:51 PM)5chn4pp Wrote: Then its fine, the malware is gone and that driver wont be important if its not in device manager, if you have any questions please ask, otherwise have a great day 🤝
Screen still does flash at some times. Just for some ms but still, annoying. What could it be? Thanks for your help and effort so far though.
Open cmd as administrator and execute this command:
Post the results here.
Also check your event viewer logs, are there anything in those?
DO NOT DEAL WITH THIS MEMBER
(Jul 20, 2017 04:55 AM)5chn4pp Wrote: Open cmd as administrator and execute this command:
Post the results here.
Also check your event viewer logs, are there anything in those?
https://i.imgur.com/cEjMXzk.png
Nothing weird in event viewer of what i can find.
Jul 20, 2017 05:46 AM
(This post was last modified: Jul 20, 2017 05:46 AM by 5chn4pp.)
If the screen is flashing, it could be the gpu. You can try to stress test your gpu, what gpu do you have?
DO NOT DEAL WITH THIS MEMBER
(Jul 20, 2017 05:46 AM)5chn4pp Wrote: If the screen is flashing, it could be the gpu. You can try to stress test your gpu, what gpu do you have?
980Ti from last year.
|