[SIM-888979]

Definitely infected, found random files in my Start Up and I scanned it and it was this:

https://www.virustotal.com/#/file/ddaba1.../detection

Not sure how I got infected.

FRST: https://pastebin.com/FDpFXHrN
Addition: https://pastebin.com/i2utArLj

[5chn4pp]

Download fixlist.txt file and save it to the Desktop.

NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

[5chn4pp]

Please download RogueKiller and save it to your desktop.

• Quit all running programs.
  


• Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
  


• Read and accept the EULA (End User License Agreement)
  


• Click Scan to scan the system.
  


• When the scan completes select "Report", a log will open. Close the program > Don't Fix anything!
  


• Post the contents of the log in your next reply.

------

Had to do this in 2 posts because something is very wrong with the HF formatting atm...

[SIM-888979]

Please download RogueKiller and save it to your desktop.

• Quit all running programs.
  


• Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
  


• Read and accept the EULA (End User License Agreement)
  


• Click Scan to scan the system.
  


• When the scan completes select "Report", a log will open. Close the program > Don't Fix anything!
  


• Post the contents of the log in your next reply.
  

------

Had to do this in 2 posts because something is very wrong with the HF formatting atm...

After completing the FRST scan yesterday, I actually went ahead and delete those processes and removed them from my Startup and Local directory, so that may be the reason why the fixlog has some not found errors.

Fixlog.txt: https://pastebin.com/8rQikspx
Rogue Killer: https://pastebin.com/zCisPQKd

[5chn4pp]

Yeah I see that, I'll do a rescan to double-check everything.

Re-Scan with FRST

• Double-Click FRST.exe or FRST64.exe to run the program.
  


• Click Yes to the disclaimer.
  


• Ensure the Addition.txt box is checked.
  


• Click the Scan button and let the program run.
  


• Upon completion, click OK, then OK on the Addition.txt pop up screen.
  


• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.
  

[SIM-888979]

Here you go.

FRST: https://pastebin.com/dbnNR7PU
Addition: https://pastebin.com/VU8z70W3

[5chn4pp]

C:\Users\justi\

You have a bunch of random files here, just delete every file that you don't recognize and tell me if something could not be deleted.

[The White House]

Holy cow, that virus scan link is gay af have never encountered it personally.

[SIM-888979]

C:\Users\justi\

You have a bunch of random files here, just delete every file that you don't recognize and tell me if something could not be deleted.

Only these two can't be deleted.

[Alexow89]

i think you got infected by Roblox RC7 Exploit hack.exe (you launch this recently, true?)

watch out for this process too :
- ddaba14a017dd5a5_svch34.exe
- 4h6f6awmv7wz.exe

[SIM-888979]

i think you got infected by Roblox RC7 Exploit hack.exe (you launch this recently, true?)

watch out for this process too :
- ddaba14a017dd5a5_svch34.exe
- 4h6f6awmv7wz.exe

I don't play Roblox, but I did run some iffy files such as a Reddit cracker and some ArmA 3 injectors.

[Smileツ]

You got lucky that it was just a btc miner.

[5chn4pp]

Download fixlist.txt file and save it to the Desktop.

NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

You got lucky that it was just a btc miner.

What? Where do you see signs of a bitcoin miner?

[.Astro]

What? Where do you see signs of a bitcoin miner?

In the VT scan, 2 scanners detected it as a miner.

[SIM-888979]

Download fixlist.txt file and save it to the Desktop.

NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.


What? Where do you see signs of a bitcoin miner?

Code

Fix result of Farbar Recovery Scan Tool (x64) Version: 26-10-2017
Ran by justi (30-10-2017 22:12:48) Run:3
Running from C:\Users\justi\Desktop
Loaded Profiles: justi (Available Profiles: justi)
Boot Mode: Normal
==============================================

fixlist content:
*****************
C:\Users\justi\RarExt.dll
*****************

C:\Users\justi\RarExt.dll => moved successfully

==== End of Fixlog 22:12:48 ====

There we go.