[keemodas]

I infect myself with a keylogger please advice on what do in the future below is the FRST and ADDITION


https://pastebin.com/yuix0QTx

[Aura]

That's the keylogger I imagine. And clear your temp folder.

Code

(Microsoft @ 2018) C:\Users\Hakeem\Desktop\dollar.exe
HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\Run: [Windows 10 Update] => C:\Users\Hakeem\Desktop\dollar.exe [377344 2018-08-19] (Microsoft @ 2018)
2018-08-19 11:14 - 2018-08-19 11:14 - 000359424 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\money.exe
2018-08-19 10:47 - 2018-08-19 10:48 - 000366080 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\doctor.exe
2018-08-19 10:46 - 2018-08-19 10:46 - 000358912 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\keemodas.exe
2018-08-19 10:42 - 2018-08-19 10:42 - 000363008 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\paymentslip.exe
2018-08-19 08:12 - 2018-08-19 08:12 - 000368128 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\aibaba.exe
2018-08-19 08:05 - 2018-08-19 08:05 - 000360960 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\invoice.exe
2018-08-19 07:44 - 2018-08-19 07:44 - 000323072 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\essien.exe
2018-01-18 02:32 - 2018-01-18 02:32 - 081366754 __RSH () C:\Users\Hakeem\AppData\Roaming\eefdNLJHnJ.exe
2018-03-18 20:31 - 2018-03-18 20:31 - 098839138 __RSH () C:\Users\Hakeem\AppData\Roaming\eepnXVTRxT.exe

Don't play with malware if you don't know what you're doing.

[๖ۣۜApocalypse]

I infect myself with a keylogger please advice on what do in the future below is the FRST and ADDITION


https://pastebin.com/yuix0QTx

Next time just use a VM, and you can play around without doing any damage to your physical PC.

[keemodas]

Next time just use a VM, and you can play around without doing any damage to your physical PC.

Thank you next time i would use VM any solution for this..

[๖ۣۜApocalypse]

Thank you next time i would use VM any solution for this..

For removing the keylogger?

[Two-Ton 21]

Maybe you shouldn't be messing with malware OP. 🤫

What do you get when you run netstat -ano in cmd? You might be able to find it that way. I'd start my system in safe mode, run a rootkit scanner, run anti malware, reboot, recheck, reformat hard drives, fresh install OS.

[keemodas]

For removing the keylogger?

Yes in case it happen in the future....

[๖ۣۜApocalypse]

Yes in case it happen in the future....

I can see in the log you have Malwarebytes, just do a scan, if it doesn't pick it up, you should try a manual removal.

[keemodas]

I can see in the log you have , just do a scan, if it doesn't pick it up, you should try a manual removal.

Malwarebytes did not pick it up...I scan many time..

[Nuworld]

That's the keylogger I imagine. And clear your temp folder.

Code

(Microsoft @ 2018) C:\Users\Hakeem\Desktop\dollar.exe
HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\Run: [Windows 10 Update] => C:\Users\Hakeem\Desktop\dollar.exe [377344 2018-08-19] (Microsoft @ 2018)
2018-08-19 11:14 - 2018-08-19 11:14 - 000359424 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\money.exe
2018-08-19 10:47 - 2018-08-19 10:48 - 000366080 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\doctor.exe
2018-08-19 10:46 - 2018-08-19 10:46 - 000358912 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\keemodas.exe
2018-08-19 10:42 - 2018-08-19 10:42 - 000363008 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\paymentslip.exe
2018-08-19 08:12 - 2018-08-19 08:12 - 000368128 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\aibaba.exe
2018-08-19 08:05 - 2018-08-19 08:05 - 000360960 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\invoice.exe
2018-08-19 07:44 - 2018-08-19 07:44 - 000323072 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\essien.exe
2018-01-18 02:32 - 2018-01-18 02:32 - 081366754 __RSH () C:\Users\Hakeem\AppData\Roaming\eefdNLJHnJ.exe
2018-03-18 20:31 - 2018-03-18 20:31 - 098839138 __RSH () C:\Users\Hakeem\AppData\Roaming\eepnXVTRxT.exe

Don't play with malware if you don't know what you're doing.

OP, Aura has already told you what to do.
Aura is the best there is and knows his shit.

Would be advised to follow his advise?

[keemodas]

That's the keylogger I imagine. And clear your temp folder.

Code

(Microsoft @ 2018) C:\Users\Hakeem\Desktop\dollar.exe
HKU\S-1-5-21-570141002-2484250258-4068607221-1000\...\Run: [Windows 10 Update] => C:\Users\Hakeem\Desktop\dollar.exe [377344 2018-08-19] (Microsoft @ 2018)
2018-08-19 11:14 - 2018-08-19 11:14 - 000359424 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\money.exe
2018-08-19 10:47 - 2018-08-19 10:48 - 000366080 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\doctor.exe
2018-08-19 10:46 - 2018-08-19 10:46 - 000358912 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\keemodas.exe
2018-08-19 10:42 - 2018-08-19 10:42 - 000363008 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\paymentslip.exe
2018-08-19 08:12 - 2018-08-19 08:12 - 000368128 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\aibaba.exe
2018-08-19 08:05 - 2018-08-19 08:05 - 000360960 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\invoice.exe
2018-08-19 07:44 - 2018-08-19 07:44 - 000323072 ____H (Microsoft @ 2018) C:\Users\Hakeem\Desktop\essien.exe
2018-01-18 02:32 - 2018-01-18 02:32 - 081366754 __RSH () C:\Users\Hakeem\AppData\Roaming\eefdNLJHnJ.exe
2018-03-18 20:31 - 2018-03-18 20:31 - 098839138 __RSH () C:\Users\Hakeem\AppData\Roaming\eepnXVTRxT.exe

Don't play with malware if you don't know what you're doing.

Thank you have clear my temp folder hope it has remove the shit...

[Eccentric]

well first it would be nice to know if the keylogger is persistent or not. If not then direct the folder it is in and delete the file and then end the tasks. If it is persistent then you have a hell of a time ahead of you.

[PerfectStorm]

I infect myself with a keylogger please advice on what do in the future below is the FRST and ADDITION


https://pastebin.com/yuix0QTx

May I ask why, the question is tempting?

[R3XDeveloper]

Do you need to use a sandbox, or worse things may happen to you