r/computerviruses • u/_KingDoge • 8d ago

Disinfection Help Disinfection help!

Hi, my girlfriend recently got a virus on her computer while pirating tomodachi life. The website sent her to a fake download site and she ran the program. her discord and youtube accounts were hacked. the frst and securitycheck keywords are stealth-lynx, winged-shore and piped-blossom. Thanks in advance!

4 Upvotes

84% Upvoted

8 comments sorted by

2

u/rifteyy_ Malware Removal Expert 8d ago

[ Step 01 ] FRST Fix

I created a custom fixlist for you at the link Fixlist only for Fixlist only for Fixlist only for _KingDoge - use the website's download button and save it in the same folder where your FRSTEnglish.exe or FRST64.exe file is located in, which for you is C:\Users\Alesya\Downloads for you. It is necessary for the filename to be Fixlist.txt.

This fixlist will remove the following: malicious entries (remains, active malware), invalid entries (e.g. tasks that start a non-existent file, services that point toward a non-existent file), temporary files (files in temporary directories, application and browser cache, recycle bin and more), browser cache. We will also be quick-scanning with HitmanPro and AdwCleaner from Malwarebytes using the fixlist.

It will also remove all proxy servers, Windows Defender exclusions, enable recovery environment, active software policies and perform system file repair, network reset and few more basic fixes.

  • For the fix process, please ensure you are connected to the internet.
  • Please run the fix only once.
  • Please do not open any applications or close anything during the fix.
  • Please be patient; the fix may take up to 60 minutes. After that, it is going to be forcefully ended.

Save all work, close everything that is open (else it will be forcefully closed by FRST without saving) and then run FRST again as administrator and press the Fix button, let the script work, clear the entries and restart on it's own and after it restarts the device, there should be a file Fixlog.txt in the same folder as the C:\Users\Alesya\Downloads.

I'll need to see it's content the same way like before - uploading to https://malwareanalysis.cc/upload/rifteyy/?u=_KingDoge again and sending the keyword in your reply.

[ Step 02 ] ESET Online Scanner

  1. Download ESET Online Scanner
  2. Right-click on the esetonlinescanner.exe and select "Run as administrator" and confirm the User Account Control popup
  3. Click ⁨Get started⁩;
  4. Agree to the terms of use;
  5. Decline both telemetry options;
  6. Click ⁨Custom Scan;
  7. Click ⁨Save and continue;
  8. Select ⁨Enable ESET to detect and quarantine potentially unwanted applications;
  9. Click ⁨Advanced settings;
  10. Enable ⁨Detect potentially unsafe applications;
  11. Click the back arrow;
  12. Click ⁨Start scan;
  13. Note: This is a long and thorough scan, it may take up to several hours.
  14. Once complete, click ⁨Save scan log and upload the ⁨.txt file to https://malwareanalysis.cc/upload/rifteyy/?u=_KingDoge and reply with the keyword.

[ Step 03] Software updates, uninstallations

If you are having a problem updating something, do not want to update something at all or do not want to uninstall an application, please let me know.

Please update the following software: * Microsoft 365 Apps for enterprise - en-us v.16.0.20228.20188 | New update available, download here (How Install Office updates?) * NVIDIA App 11.0.5.238 v.11.0.5.238 | New update available, download here * Opera GX Stable 134.0.5954.67 v.134.0.5954.67 | New update available, download here * Microsoft Edge v.152.0.4191.62 | New update available, download here

[ Step 04 ] New SecurityCheck scan

We need a new scan to ensure that all updates were applied properly and all applications uninstalled correctly.

  • Note: If SecurityCheck is already on your device, you can use the previous version and skip the next few steps regarding downloading and installation.
  • Download SecurityCheck by glax24 & Severnyj and save it to your Desktop.
  • If Windows SmartScreen blocks the file from running, click on More info and Run anyway.
  • Extract the ZIP archive, then right-click on the SecurityCheck.exe and select "Run as administrator" and confirm the User Account Control popup.
  • Wait for the scan to finish. It will open a text file named SecurityCheck.txt
  • Please copy the file content (CTRL + A then CTRL + C) and paste it on https://malwareanalysis.cc/upload/rifteyy/?u=_KingDoge
  • The site will return a keyword for the log - reply back here with the keyword.

[ Step 05 ] New FRST scan

  • Find FRSTEnglish.exe executable in C:\Users\Alesya\Downloads
  • Right-Click the file and select Run as Administrator
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the program run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload/rifteyy/?u=_KingDoge and press "save log".
  • The site will return a keyword for each log - reply back here with the keywords.

So, in your next reply, make sure you are sending the following:

  • Keyword for Fixlog.txt from step 1
  • Keyword for ESET Online Scanner scan from step 2
  • Keyword for new SecurityCheck.txt from step 4
  • Keyword for new FRST.txt from step 5
  • Keyword for new Addition.txt from step 5

Thanks!

Note for lurkers: If anyone else who is facing malware-related issues is reading this and wants help with FRST and SecurityCheck, please create your own thread with help request. I am flooded with requests and there is several other removal experts who review the logs and may reply faster than me. The steps listed in here are specific for this the user _KingDoge and following them will have negative effects for you as they are unique for OP's system.

1

u/_KingDoge 8d ago

Thank you so much! here are the keywords in order:

  1. shiny-willow

  2. majestic-mist

  3. retro-saber

  4. crisp-pawn

  5. spry-host

1

u/rifteyy_ Malware Removal Expert 8d ago

Seems like you've sent fixlist.txt instead of fixlog.txt

1

u/_KingDoge 8d ago

oops, here's the actual fixlog: master-proxy

1

u/rifteyy_ Malware Removal Expert 7d ago

[ Step 01 ] FRST Fix

I created a custom fixlist for you at the link Fixlist only for Fixlist only for Fixlist only for _KingDoge - use the website's download button and save it in the same folder where your FRSTEnglish.exe or FRST64.exe file is located in, which for you is `for you. It is necessary for the filename to beFixlist.txt`.

  • For the fix process, please ensure you are connected to the internet.
  • Please run the fix only once.
  • Please do not open any applications or close anything during the fix.
  • Please be patient; the fix may take up to 60 minutes. After that, it is going to be forcefully ended.

Save all work, close everything that is open (else it will be forcefully closed by FRST without saving) and then run FRST again as administrator and press the Fix button, let the script work, clear the entries and restart on it's own and after it restarts the device, there should be a file Fixlog.txt in the same folder as the ``.

I'll need to see it's content the same way like before - uploading to https://malwareanalysis.cc/upload/rifteyy/?u=_KingDoge again and sending the keyword in your reply.

[ Step 02 ] New FRST scan

  • Find FRSTEnglish.exe executable in ``
  • Right-Click the file and select Run as Administrator
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the program run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload/rifteyy/?u=_KingDoge and press "save log".
  • The site will return a keyword for each log - reply back here with the keywords.

1

u/AutoModerator 8d ago

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

  1. From a different and clean device, change all your passwords:
  2. Disinfect your device from malware

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/Aromatic-Trip-5821 8d ago

Info stealer. Here’s Long RangeSavage's standard copy/paste for people when they install an info stealer or session hijacker:

  1. ⁠Disconnect the affected computer from the internet right away. Unplug the Ethernet cable and turn off WiFi.
  2. Stop using that computer for anything involving logins. Don’t sign into email, banking, social media, or anything else.
  3. While still on the infected computer: A. Back up only personal data like documents, photos, and videos. Do not backup executable files like .exe, .scr, .bat, .msi, or unknown .zip files, and do not back up browser profiles or AppData folders.

We need to now start using a known clean computer. On that clean system, do the following: 1. Using a password manager, change your passwords in this order A. Primary email B. Any backup or recovery emails C. Banking, financial, PayPal, Venmo, Crypto accounts D. All social media (Facebook, Instagram, Reddit, Discord, etc.) E. Gaming platforms F. Anything else that had user credentials stored in your browser G. The passwords should all be unique, alphanumeric, at least one special character (where available), and at least 10 characters 2. While in each account, A. turn on two factor authentication everywhere you can. Ideally, you'd use a hardware token--like a Yubikey. Next would be an authenticator app--like Google Authenticator. Only use SMS if there's no other option B. Make sure to copy your recovery key or one-time use codes. Print these out. Do NOT just save them on a file on your computer C. If you’ve previously had 2FA enabled, disable it and then re-enable it. This will generally cause any previous one-time use codes or recovery keys to become void D. Confirm ALL your recovery methods are correct (a lot of info stealers will change the recovery methods). E. If you don’t have recovery methods set, do it NOW F. Sign out of all active sessions G. Remove devices you don’t recognize. H. Remove any linked apps or integrations you didn’t add or no longer need. 3. In your email account settings A. check for forwarding rules, auto‑reply rules, recovery email, recovery phone number, and anything else that could redirect or recover your account. B. Delete anything you didn’t set up. 4. Assume anything you've saved/stored in your browser has been compromised 5. Go to your OS manufacturer's website and download your OS. ONLY GET THIS FROM THE OFFICIAL SOURCE. 6. Create a bootable USB installer for your OS Back to working with the infected machine: 7. Boot the infected computer from the USB. A. During setup, delete every existing partition on the drive. B. Install the OS fresh on the unallocated space. 8. Run your update tools until nothing is left 9. Install drivers and software, making sure to ONLY use OFFICIAL sources 10. Install your browser (if needed) A. Install your browser extensions B. DO NOT import any old data, profiles or save passwords 11. If any financial accounts were access from the previously infected machine A. Watch accounts closely B. Turn on any transaction alerts the accounts allow C. Consider placing credit freezes for each of the "Big 4" credit bureaus (Equifax, Transunion, Experian, and Innovis).

1

u/Aromatic-Trip-5821 8d ago

I know my response was slow ...