Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

Check-Up 

Might have something sketchy on my PC

FRST: https://pastebin.com/Bf2EtrZJ
Addition: https://pastebin.com/NTkM4ZVP

The screen flashes some times, keys get fucked up for some reason and starts opening programs instead of doing what they should.
You have a rat, and there is a driver issue with your mouse and keyboard.

Download fixlist.txt file and save it to the Desktop.

NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
(Jul 19, 2017 09:02 AM)5chn4pp Wrote:  You have a rat, and there is a driver issue with your mouse and keyboard.

Download fixlist.txt file and save it to the Desktop.

NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

https://pastebin.com/BGdneL8D
The dlihost was my own rat I tested just to see if it were working some time ago, I'm pretty sure of.
There was also another rat, please upload this folder to https://share.riseup.net/ and post the link here:

C:\Users\granz\Desktop\19.07.2017_18.05.21.zip

----------

Please download RogueKiller and save it to your desktop.
  • Quit all running programs.

  • Right-click on the program and select Run as Administrator to start and when prompted allow it to run.

  • Read and accept the EULA (End User License Agreement)

  • Click Scan to scan the system.

  • When the scan completes select "Report", a log will open. Close the program > Don't Fix anything!

  • Post the contents of the log in your next reply.


https://share.riseup.net/#7vekuI8egO303FIRTkFtiw
https://pastebin.com/9DuVJa3z
These files are password stealers and a bitcoin stealer, I recommend you change all of your passwords.

Now to the driver, please open device manager and post a screenshot of the drivers.
(Jul 19, 2017 10:43 AM)5chn4pp Wrote:  These files are password stealers and a bitcoin stealer, I recommend you change all of your passwords.

Now to the driver, please open device manager and post a screenshot of the drivers.
Are they gone now?
https://i.imgur.com/1VW2BCo.png
Yeah I deleted it, do you see a "Trusted Platform Module 2.0" device in device manager? Try to enable it.
(Jul 19, 2017 06:54 PM)5chn4pp Wrote:  Yeah I deleted it, do you see a "Trusted Platform Module 2.0" device in device manager? Try to enable it.

Can't find.
(Jul 19, 2017 07:25 PM)Dopeish Wrote:  Can't find.

Then its fine, the malware is gone and that driver wont be important if its not in device manager, if you have any questions please ask, otherwise have a great day 🤝
(Jul 19, 2017 07:51 PM)5chn4pp Wrote:  Then its fine, the malware is gone and that driver wont be important if its not in device manager, if you have any questions please ask, otherwise have a great day 🤝

Screen still does flash at some times. Just for some ms but still, annoying. What could it be? Thanks for your help and effort so far though.
Open cmd as administrator and execute this command:

Code
sfc /scannow

Post the results here.

Also check your event viewer logs, are there anything in those?
(Jul 20, 2017 04:55 AM)5chn4pp Wrote:  Open cmd as administrator and execute this command:

Code
sfc /scannow

Post the results here.

Also check your event viewer logs, are there anything in those?

https://i.imgur.com/cEjMXzk.png
Nothing weird in event viewer of what i can find.
If the screen is flashing, it could be the gpu. You can try to stress test your gpu, what gpu do you have?
(Jul 20, 2017 05:46 AM)5chn4pp Wrote:  If the screen is flashing, it could be the gpu. You can try to stress test your gpu, what gpu do you have?

980Ti from last year.


Possibly Related Threads...
Thread / Author Replies Views Last Post
[Check-Up] by FuggAug 4, 2019 10:02 PM 6 355 Aug 4, 2019 10:02 PM
Last Post: A Few Problems
[Infected] by KaxonApr 18, 2018 08:43 AM 4 201 Apr 18, 2018 08:43 AM
Last Post: SecurityCult
[Infected] by HexalogyJun 11, 2017 12:40 PM 10 309 Jun 11, 2017 12:40 PM
Last Post: Hexalogy