Sep 2, 2017 08:50 AM
(This post was last modified: Sep 2, 2017 09:13 AM by beam2546.)
I Accidentally ran this file: h tt ps :/ / www . hybrid-analysis . com/ sample/ 86e34aaa180e9c2ddf7dee279af51dcdd9b661881884ad46404dfb6714994123?environmentId=100(Sorry, I have to bypass this requirement)
I'm very worry right now since my antivirus (Kaspersky) is dumb enough. They're not even notice about it. And I think this file is RAT too. This computer have little bit sensitive information. Included my PayPal and Internet banking account too. So Can someone help me please?😭
Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
- Right click to run as administrator. When the tool opens click Yes to disclaimer.
- Press Scan button.
- It will produce logs called FRST.txt and Addition.txt in the same directory the tool is run from.
- Please copy and paste the logs back here.
FRST.txt: pastebin. com/ ipQgExak
Addition.txt: pastebin. com/ naXwEfaL
Thank you very much😉
(Sep 2, 2017 07:39 PM)beam2546 Wrote: FRST.txt: pastebin. com/ ipQgExak
Addition.txt: pastebin. com/ naXwEfaL
Thank you very much😉
Download fixlist.txt file and save it to the Desktop.
NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
----------
Please download Junkware Removal Tool to your desktop. - Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
- The tool will open and start scanning your system.
- Please be patient as this can take a while to complete depending on your system's specifications.
- On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
- Post the contents of JRT.txt into your next message.
(Sep 2, 2017 07:41 PM)reda.png Wrote: ur really nice for helping ppl out <3
Thanks, I try my best. 😊
Fixlog.txt: pastebin. com/ Gz2me1WA
JRT.txt: pastebin. com/ 6iymHHq7
Thank you very much for helping me🙂
(Sep 3, 2017 05:16 AM)beam2546 Wrote: Fixlog.txt: pastebin. com/ Gz2me1WA
JRT.txt: pastebin. com/ 6iymHHq7
Thank you very much for helping me🙂
Looks good so far, last 2 scans:
Please download RogueKiller and save it to your desktop. - Quit all running programs.
- Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
- Read and accept the EULA (End User License Agreement)
- Click Scan to scan the system.
- When the scan completes select "Report", a log will open. Close the program > Don't Fix anything!
- Post the contents of the log in your next reply.
----------
Please download HitmanPro and save it to your desktop. - Quit all running programs.
- Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
- Click the settings tab and go into Advanced, then enable Early Warning Scoring.
- Click OK and Next then select No, I only want to perform a one-time scan to check this computer.
- Click Next and it should start the scan, please be patient.
- When the scan completes click "Save log", and save it to your desktop. Close the program > Don't Fix anything!
- Post the contents of the log in your next reply.
RogueKiller: pastebin. com/ Z12WcZif
HitmanPro: pastebin. com/ bVhMvfHr
Do you have a proxy set?
Also delete everything in this folder:
C:\Users\BEAM\AppData\Local\Temp\
If something is running and cant be deleted, just skip it.
Disconnect your PC from the WiFi ASAP
(Sep 4, 2017 04:15 PM)QQ Spitfire Wrote: Disconnect your PC from the WiFi ASAP
Read the thread as Bromo has already taken care of it.
(Sep 4, 2017 04:15 PM)QQ Spitfire Wrote: Disconnect your PC from the WiFi ASAP
What would this help with?
While Bromo seems to have covered this, shouldn't running Malwarebytes also help as a last cleanup solution after you get rid of the RAT?
Haven't delved into this problem but just from a general standpoint...
My hat used to be somewhere along the border of being grey but over the past few years, I realized my calling is to learn and help others out in ways that I can ethically. Learn as much as you can, experience, grow, educate, and throw yourself in uncomfortable situations.
(Sep 4, 2017 11:35 PM)bdawn Wrote: While Bromo seems to have covered this, shouldn't running Malwarebytes also help as a last cleanup solution after you get rid of the RAT?
Haven't delved into this problem but just from a general standpoint...
I mean you can, but its not really necessary.
Also this guy has Malwarebytes installed, so I'm assuming he has ran it already.
(Sep 4, 2017 12:37 AM)5chn4pp Wrote: Do you have a proxy set?
Also delete everything in this folder:
C:\Users\BEAM\AppData\Local\Temp\
If something is running and cant be deleted, just skip it.
I never have a proxy set. Cleared everything in Temp file aswell.😉
(Sep 5, 2017 04:26 AM)beam2546 Wrote: I never have a proxy set. Cleared everything in Temp file aswell.😉
Run roguekiller again and delete everything called [PUM.Proxy]
After that you should be clean.
|
