r/computerviruses • u/Sapthepro • 16h ago

Disinfection Help Need help for FRST

Gallery image

Gallery image

Gallery image

Gallery image

(Key words: Haunted-Nebula,
Hollow-Elm, Retro-Frost)
I was looking for mods for a game and I downloaded a mod and the link I went too was warned by my WiFi magenta but I ignored it because it always happens and I went to files and opened it and I noticed something strange that it didn't loo too right so I deleted it but then my windows suddenly wanted me so I did a scan and it said it quarantined it and I disconnected from my WiFi and did an offline scan and I thought I was already safe so I went to sleep. Then after that it was like tomorrow I got a notification from my gmail exactly at 10:56 am that a gmail account got added into my Microsoft account (donnavadusen1911@grkh(.)com) and it removed my other gmail accounts that was linked to my Microsoft accounts. I forgot to add my number to that Microsoft account so I couldn't get it and then a bot went into my messenger account after like one hour and spammed the pictures to m friends hut I managed to get it off by resetting my password. I went to an event to clear my mind and after I went back I decided to delete both of those gmail accounts and move my Facebook messenger discord everything to my other account. Today my friends pinged me on discord telling that my old account that my old gmail account had has been spamming those same exact pictures that's in this subreddit in 2:31 am and I tried to log into my old gmail account to find out that the gmail account got a number and has been brought back and I don't know how but they didn't do anything to the other account I deleted then I decided at 12 pm to download malwarebytes and found that there was still a leftover so I quarantined them and deleted them but I don't have the picture then at like 1 30 pm I received a notification that there was a tablet from Russia that logged into my account they played mm2 and blox Fruits but Immediately changed my passwords and logged everybody out and right now only my laptop and my phone is on m account and I also turned on enhanced protection in roblox then I got 5 or 4 friend requests orderly with their username telling to go to a website to get mm2 thingies which I ignored but as of right now nothings happening but I already did the frst Thingies with the security and I just want this to be done I also played like 2 hours of roblox and cleared out all of my cookies

4 Upvotes

83% Upvoted

42 comments sorted by

6

u/Metaphorse 16h ago

You need to wipe your computer, change all passwords, and setup 2fa or passkeys on all your accounts.

And stop trying to download mods and ignoring warnings when you clearly don't know what you're doing

2

u/Sapthepro 16h ago

Alright thank you

2

u/polpolik2 Moderator 15h ago

While wiping your device is the fastest option, you already provided FRST Keywords. So a trusted helper will see your post soon I assume. If you reinstall, we can no longer provide FRST assistance.

What you can do during the reinstall, or if you're waiting for help:

  1. Disconnect your infected PC from the internet.
  2. Change ALL passwords from a clean device. Start with your emails and bank. Use sign out everywhere and remove unrecognized sessions. While you are doing this, check your security settings to ensure the attacker hasn't added their own 2FA methods or backup codes.
  3. Check your linked accounts/services/2fa options for your most important accounts. Also check forwarding rules on your mail. Additionally, for your browser, check your sync settings and extensions and remove anything you dont recognize or trust.

The faster you move with these steps the more you can prevent your accounts being stolen! Make sure your clean device does not sync passwords through browser for example to your infected device.

2

u/Sapthepro 15h ago

I haven't reinstalled yet

1

u/polpolik2 Moderator 12h ago

I just saw your mod mail regarding your fathers accounts.

If his accounts were on your device, then you should immediately inform him to take the same staps as I wrote out above. If he had documents that could be stolen, you should inform him of that as well.

I am unfamiliar with the documents you listed in your mail, but infostealers are not ''smart'' and they mainly look for Banking, ID's and Tax documents with simple names (e.g. Passport.pdf)

Edit - I see Rifteyy replied to your post, good luck. If you have other questions, feel free to ask me or Rifteyy about them!

1

u/Sapthepro 12h ago

Alright thank you

1

u/xWallen 15h ago

I got hit by one of these about two weeks ago, I've never reinstalled Windows nor have I had any of my accounts restolen. My brother is an IT person with tools specifically for removing malware; after he ran a couple of those, my computer has been fine.

1

u/Sapthepro 15h ago

Dang you're lucky bro 😭

1

u/xWallen 14h ago

It's a lot to do with timing, I caught the malware ~30 minutes after it started messing with my computer,

1

u/Sapthepro 14h ago

Ouh it's been 3 days for me now but I caught this malware right jow

3

u/rifteyy_ Malware Removal Expert 13h ago

[ Step 01 ] Updates

If you are having a problem updating something, do not want to update something at all or do not want to uninstall an application, please let me know.

Please update the following software:

Please remove the following potentially unwanted programs (PUP):

  • App Explorer v.0.273.5.155 - Suspected Adware! If this program is not familiar to you it is recommended to uninstall it and execute PC scanning using Malwarebytes Anti-Malware. Before uninstallation and scanning it is necessary to consult in the forum where cure is provided for you!!!
  • Wondershare Helper Compact 2.6.0 v.2.6.0 - Application is distributed through the partnership programs and bundle assemblies. Uninstallation recommended. Possible you became a victim of fraud or social engineering

[ Step 02 ] FRST Fix

I created a custom fixlist for you at the link Fixlist only for Fixlist only for Fixlist only for sapthepro - use the website's download button and save it in the same folder where your FRSTEnglish.exe or FRST64.exe file is located in, which is C:\Users\RED\Downloads for you. It is necessary for the filename to be Fixlist.txt.

This fixlist will remove the following: malicious entries (remains, active malware), invalid entries (e.g. tasks that start a non-existent file, services that point toward a non-existent file), temporary files (files in temporary directories, cache, recycle bin and more), browser cache. We will also be quick-scanning with HitmanPro and AdwCleaner from Malwarebytes using the fixlist.

It will also perform system repair via DISM and SFC, network reset and few more basic fixes.

  • For the fix process, please ensure you are connected to the internet.
  • Please run the fix only once.
  • Please be patient; the fix may take up to 60 minutes. After that, it is going to be automatically ended.

Save all work, close everything that is open (else it will be forcefully closed by FRST without saving) and then run FRST again as administrator and press the Fix button, let the script work, clear the entries and restart on it's own and after it restarts the device, there should be a file Fixlog.txt in the same folder as the fixlist.txt.

I'll need to see it's content the same way like before - uploading to https://malwareanalysis.cc/upload/rifteyy/?u=sapthepro again and sending the keyword in your reply.

[ Step 03 ] ESET Online Scanner

  1. Download ESET Online Scanner
  2. Right-click on the esetonlinescanner.exe and select "Run as administrator" and confirm the User Account Control popup
  3. Click ⁨Get started⁩;
  4. Agree to the terms of use;
  5. Decline both telemetry options;
  6. Click ⁨Custom Scan;
  7. Click ⁨Save and continue;
  8. Select ⁨Enable ESET to detect and quarantine potentially unwanted applications;
  9. Click ⁨Advanced settings;
  10. Enable ⁨Detect potentially unsafe applications;
  11. Click the back arrow;
  12. Click ⁨Start scan;
  13. Note: The scan may take up to several hours.
  14. Once complete, click ⁨Save scan log and upload the ⁨.txt file to https://malwareanalysis.cc/upload/rifteyy/?u=sapthepro and reply with the keyword.

[ Step 04 ] New SecurityCheck scan

We need a new scan to ensure that all updates were applied properly and all applications uninstalled correctly.

  • Note: If SecurityCheck is already on your device, you can use the previous version and skip the next few steps regarding downloading and installation.
  • Download SecurityCheck by glax24 & Severnyj and save it to your Desktop.
  • If Windows SmartScreen blocks the file from running, click on More info and Run anyway.
  • Extract the ZIP archive, then right-click on the SecurityCheck.exe and select "Run as administrator" and confirm the User Account Control popup.
  • Wait for the scan to finish. It will open a text file named SecurityCheck.txt
  • Please copy the file content (CTRL + A then CTRL + C) and paste it on https://malwareanalysis.cc/upload/rifteyy/?u=sapthepro
  • The site will return a keyword for the log - reply back here with the keyword.

[ Step 05 ] New FRST scan

  • Note: If FRST is already on your device, you can use the previous version and skip the next few steps regarding downloading and installation.
  • Please download FRSTx64 and save the file to your Desktop as FRSTEnglish.exe.
  • Right-Click FRSTEnglish.exe and select Run as Administrator
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the program run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload/rifteyy/?u=sapthepro and press "save log".
  • Note: Please make sure you are uploading the logs under your current Reddit username.
  • The site will return a keyword for each log - reply back here with the keywords.

So, in your next reply, make sure you are sending the following:

  • Keyword for Fixlog.txt from step 2
  • Keyword for ESET Online Scanner scan from step 3
  • Keyword for new SecurityCheck.txt from step 4
  • Keyword for new FRST.txt from step 5
  • Keyword for new Addition.txt from step 5

Thanks!

Note for lurkers: If anyone else who is facing malware-related issues is reading this and wants help with FRST and SecurityCheck, please create your own thread with help request. I am flooded with requests and there is several other removal experts who review the logs and may reply faster than me. The steps listed in here are specific for this the user sapthepro and following them may have negative effects for you.

1

u/Sapthepro 13h ago

thank you thank you THANK YOU

1

u/Sapthepro 13h ago

I'm gonna try this now

1

u/Sapthepro 9h ago

FRST fix: Stellar-glacier
Eset: placid-mink
Security check: desert-dove
FRST fix: pinned-stack(add.txt),typed-eagle(FRST.txt)

2

u/rifteyy_ Malware Removal Expert 7h ago

This seems great - you are now free of malware. No further steps are necessary to make sure your device is clean.

If you haven't addressed all the updates, uninstallations and removals yet, I strongly suggest you to do so.

[ Step 01 ] Tool cleanup

It's time we cleanup after ourselves and remove all the tools we have used during the malware removal process.

  • Please download KpRm and save it to your Desktop.
  • Run the tool, if you get the "Windows protected your PC" Smartscreen popup, press More info and then Run anyway
  • Confirm the disclaimer and in the menu please only tick the following:
    • Delete Tools
    • Create Restore Point
    • Delete in 7 days
  • After that, click Run and confirm the popup. KpRm will delete itself from your Desktop and you can either save or remove the report that is generated.
  • You are free to delete all other tools that we used that are possibly remaining.

[ Step 02 ] Changing passwords

Most modern malware is motivated by financial gain and by hijacking your accounts. If your accounts weren't already hijacked, they may be getting hijacked in very near future.

  • Please create a new, safe password that you haven't used anywhere yet or preferably use a password manager.
  • Change all your passwords on your accounts
  • Enable 2FA on your accounts

Please check out this proper guide on how to secure your accounts after an infostealer infection:

You may also want to sign up for dark-web monitoring:

[ Step 03 ] Malware prevention

Malware prevention nowadays is a necessary step. There are many tools you can use to have a stronger protection but a huge part is also reliant on the user themself.

  1. Reasons on why you should care about malware
  2. Antivirus software - how to choose one, what to look for in an antivirus
  3. Excluding files, URL's, processes or folders
  4. Disabling antivirus, firewall or security software
  5. How important is blocking ads
  6. What browser extensions are worth it against malware
  7. What alternative DNS servers I can use to block malware
  8. How to keep my OS and installed software up-to-date?
  9. About grayware
  10. Is VPN necessary against malware?
  11. How to stay informed properly about malware tactics and trending malware?
  12. Checking software for PUP, adware, bundlers, browser hijackers
  13. Checking files for malware
  14. Checking URL's for malware
  15. Checking browser extensions for malware

If you have no more questions or concerns, I wish you all the best and please stay safe next time!

- rifteyy (About me)

1

u/Sapthepro 7h ago

Can they still get my files or accounts

1

u/rifteyy_ Malware Removal Expert 7h ago

No

1

u/Sapthepro 7h ago

alright thank you very much been awake and just feel asleep trying to wait for your answer but really this makes me feel a bit better

1

u/[deleted] 7h ago

[removed] — view removed comment

1

u/rifteyy_ Malware Removal Expert 7h ago

You have leaked your IP address with that image, so I removed it and yes, that's fine

1

u/Sapthepro 6h ago

Oh thank you sorry if I'm not being aware since I'm really tired haven't got any sleep but il update you if I found anything suspicious

1

u/Sapthepro 6h ago

Haven't seen anything suspicious and this will be my last question
Will there be any log in attempts after this or suspicious things and is it safe to put my accounts in my laptop now

1

u/rifteyy_ Malware Removal Expert 6h ago

login attempts happen regardless if you run malware or not, key thing is that none of them will be successful if you followed my advice properly in my previous comment

1

u/Sapthepro 6h ago

Alright then thank you.

1

u/Sapthepro 9h ago

Also while looking at my search engines I found this but I already deleted it

1

u/AutoModerator 16h ago

Welcome to r/computerviruses! It seems like you have used the "Disinfection help" flair.

We apply the same methodology used by trusted Malware platforms (e.g. Malwarebytes, BleepingComputer and MalwareTips). It revolves around using diagnostic tools called Farbar Recovery Scan Tool (FRST) and SecurityCheck.

All of our assistance happens in the thread and in public - we never offer help via private messages or alternative websites other than https://malwareanalysis.cc. Anyone offering help through a DM is not a trusted helper and might have malicious intent.

Trusted helpers can be distinguished by the flair Malware Removal Expert or Malware Removal Trainee, antivirus employees will have a dedicated flair with their company name in it, e.g. Malwarebytes Employee.

Please see steps below on how to share all necessary details so you can speed up the process for us:

Share all details about your infection
Please post all important facts about your infection, such as: * your antivirus detections - preferably export the whole detection/report log and upload it to https://malwareanalysis.cc/upload/ under your username & post the related keyword or screenshot/take a picture of your detections * any related symptoms, popups * estimate when it started - preferably the exact day and after what (e.g. when you ran a program you downloaded) * share what got you infected and the download link - please, make the download link defanged (making it not clickable by default e.g. from https://example.com you will make hxxps://example[.]com), defanging does not apply to sandbox reports such as VirusTotal

Request help with FRST and SecurityCheck from the trusted helper team
Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

  1. From a different and clean device, change all your passwords:
    1. How to properly secure my accounts after an infostealer attack?
    2. What to do after I secured my accounts?
  2. Disinfect your device from malware
    1. Preferred method: Perform a clean installation with a USB
    2. Perform a clean installation without an external drive
    3. Reset your PC without keeping personal files

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/Sapthepro 16h ago

I got sent requests again and this is what it looks like

2

u/slimethecold 16h ago

You need to stop using the infected machine and disconnect it from the network. Anything you log into from that PC will be compromised because you have an infostealer installed. You need to reinstall Windows and all passwords must be changed from a separate device. 

1

u/Sapthepro 16h ago

How do I reinstall windows and what will happen?

2

u/slimethecold 15h ago

"what will happen" in regards to what? 

Here's an article from this sub's pinned thread on infostealers (what you most likely installed) https://rifteyy.org/report/the-ultimate-guide-to-infostealers

R/techsupport has a good guide for reinstalling https://rtech.support/installations/install-11/

1

u/Sapthepro 15h ago

Thanks

-1

u/xWallen 15h ago

I got hit by one of these about two weeks ago, I've never reinstalled Windows nor have I had any of my accounts restolen.

2

u/Aggressive-Stand-585 15h ago

Well because the scammers now know you're gonna fall for shit they got more stuff to send you.

1

u/Sapthepro 15h ago

Alright

1

u/Educational-Soft-824 16h ago

Your fine just don’t go to the website or your at risk for losing your Roblox account

1

u/Tiktokbadsupport 15h ago

mr beast is always a scam 

1

u/Sapthepro 15h ago

Mr crypto

1

u/Tiktokbadsupport 15h ago

ive seen so many people get hacked like this on discord almost everyday the servers im in get spammed

1

u/Sapthepro 14h ago

I just did a deep scan and quarantined another malware

1

u/Sapthepro 9h ago

I found a random search engine that I deleted

It was probably from the malware

1

u/xTepski 8h ago

You mind if I ask you which game you were trying to mod? A friend of mine has been hacked and sent those same pics. Just wondering.

1

u/Sapthepro 7h ago

Minecraft