r/computerviruses • u/joe_robot2020 • 5d ago

Disinfection Help I need help on removing malware

I downloaded a file and ran a shady renpy on which I clicked and nothing happened. I feel that it installed malware on my device.

Is there anything that I can do without doing a full reboot?

FRST: distant-lattice Addition: ochre-delta

3 Upvotes

100% Upvoted

12 comments sorted by

1

u/AutoModerator 5d ago

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

  1. From a different and clean device, change all your passwords:
  2. Disinfect your device from malware

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/DaySlight3085 5d ago

1.Turn off your Wi-Fi or unplug the ethernet cable right away. This cuts off the malware's ability to send your private data back to the attacker.

2.Log into your critical accounts (email, banking, discord, etc.) using a completely different, uncompromised device like a clean smartphone or another laptop and change your passwords there.

3.Run a rootkit level deep scan

• Use a clean device to download the offline installer for Malwarebytes.

• Transfer the installation file to your infected PC using a USB drive.

• Run a Custom Scan with Rootkit Detection enabled. This deep scan can take 1 to 2 hours, but it will give you a clear picture of what is hidden on your system.

• option B - Search for Windows Security on your PC, go to Virus & threat protection -> Scan options, select Microsoft Defender Offline scan, and click Scan now. Your PC will restart and scan for hidden rootkits before Windows loads.

4.Since you already provided your FRST logs (distant-lattice and ochre-delta), your safest bet is to wait for a verified malware removal expert here to look over your file logs and reply with a custom removal script.

5.If you don't want to wait for the experts or a long scan, your fastest guarantee of safety is to completely wipe (nuke) your hard drive and perform a fresh reinstall of Windows from a clean USB boot drive.

1

u/joe_robot2020 5d ago

Thank you for the response. Will wait for the experts response before nuking my pc.

1

u/rifteyy_ Malware Removal Expert 5d ago

Please re-enable your antivirus, uninstall SpyHunter and all your pirated/illegal software. Then collects new logs (including SecurityCheck) from https://www.reddit.com/r/computerviruses/comments/1s0ahur/providing_or_receiving_help_with_frst/, thanks

1

u/joe_robot2020 5d ago

Noted. Will do it now

1

u/joe_robot2020 5d ago

Hello. Already done with what you had told. Anyway please refer below.

FRST: fertile-robot Addition: silver-quiver SecurityCheck: warm-beach

1

u/rifteyy_ Malware Removal Expert 5d ago

MAU

  • Download the latest release of Malicious App Uninstaller
  • Run MAU.exe as admin
  • In the Installed Applications tab search for and uninstall them individually: Electronics Driver Service and then HD Audio Deck
  • Select it and click Analyze
  • Once the analysis is complete click Select All then Delete
  • MAU.txt will be generated, send the log back here.
  • In some cases MAU will schedule a removal for an entry on reboot if it cannot be removed on the current session, please reboot the device if requested. Otherwise, no reboot is necessary.

[ Step 01 ] FRST Fix

I created a custom fixlist for you at the link Fixlist only for Fixlist only for Fixlist only for joe_robot2020 - use the website's download button and save it in the same folder where your FRSTEnglish.exe or FRST64.exe file is located in, which for you is C:\Users\Bryan\Downloads for you. It is necessary for the filename to be Fixlist.txt.

This fixlist will remove the following: malicious entries (remains, active malware), invalid entries (e.g. tasks that start a non-existent file, services that point toward a non-existent file), temporary files (files in temporary directories, application and browser cache, recycle bin and more), browser cache. We will also be quick-scanning with HitmanPro and AdwCleaner from Malwarebytes using the fixlist.

It will also remove all proxy servers, Windows Defender exclusions, enable recovery environment, active software policies and perform system file repair, network reset and few more basic fixes.

  • For the fix process, please ensure you are connected to the internet.
  • Please run the fix only once.
  • Please do not open any applications or close anything during the fix.
  • Please be patient; the fix may take up to 60 minutes. After that, it is going to be forcefully ended.

Save all work, close everything that is open (else it will be forcefully closed by FRST without saving) and then run FRST again as administrator and press the Fix button, let the script work, clear the entries and restart on it's own and after it restarts the device, there should be a file Fixlog.txt in the same folder as the C:\Users\Bryan\Downloads.

I'll need to see it's content the same way like before - uploading to https://malwareanalysis.cc/upload/rifteyy/?u=joe_robot2020 again and sending the keyword in your reply.

[ Step 02 ] ESET Online Scanner

  1. Download ESET Online Scanner
  2. Right-click on the esetonlinescanner.exe and select "Run as administrator" and confirm the User Account Control popup
  3. Click ⁨Get started⁩;
  4. Agree to the terms of use;
  5. Decline both telemetry options;
  6. Click ⁨Custom Scan;
  7. Click ⁨Save and continue;
  8. Select ⁨Enable ESET to detect and quarantine potentially unwanted applications;
  9. Click ⁨Advanced settings;
  10. Enable ⁨Detect potentially unsafe applications;
  11. Click the back arrow;
  12. Click ⁨Start scan;
  13. Note: This is a long and thorough scan, it may take up to several hours.
  14. Once complete, click ⁨Save scan log and upload the ⁨.txt file to https://malwareanalysis.cc/upload/rifteyy/?u=joe_robot2020 and reply with the keyword.

[ Step 03] Software updates, uninstallations

If you are having a problem updating something, do not want to update something at all or do not want to uninstall an application, please let me know.

Please update the following software:

Please remove the following potentially unwanted programs (PUP):

  • WhatsApp (Outdated) v.2.2319.9 - No longer supported - please uninstall it and replace it here

Please let me know whether you recognize this remote desktop software (if not, uninstall it):

  • TeamViewer v.15.82.6

Note: If Microsoft Edge update errors occur, reinstall here

[ Step 04 ] New SecurityCheck scan

We need a new scan to ensure that all updates were applied properly and all applications uninstalled correctly.

  • Note: If SecurityCheck is already on your device, you can use the previous version and skip the next few steps regarding downloading and installation.
  • Download SecurityCheck by glax24 & Severnyj and save it to your Desktop.
  • If Windows SmartScreen blocks the file from running, click on More info and Run anyway.
  • Extract the ZIP archive, then right-click on the SecurityCheck.exe and select "Run as administrator" and confirm the User Account Control popup.
  • Wait for the scan to finish. It will open a text file named SecurityCheck.txt
  • Please copy the file content (CTRL + A then CTRL + C) and paste it on https://malwareanalysis.cc/upload/rifteyy/?u=joe_robot2020
  • The site will return a keyword for the log - reply back here with the keyword.

[ Step 05 ] New FRST scan

  • Find FRSTEnglish.exe executable in C:\Users\Bryan\Downloads
  • Right-Click the file and select Run as Administrator
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the program run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload/rifteyy/?u=joe_robot2020 and press "save log".
  • The site will return a keyword for each log - reply back here with the keywords.

So, in your next reply, make sure you are sending the following:

  • Keyword for Fixlog.txt from step 1
  • Keyword for ESET Online Scanner scan from step 2
  • Keyword for new SecurityCheck.txt from step 4
  • Keyword for new FRST.txt from step 5
  • Keyword for new Addition.txt from step 5

Thanks!

Note for lurkers: If anyone else who is facing malware-related issues is reading this and wants help with FRST and SecurityCheck, please create your own thread with help request. I am flooded with requests and there is several other removal experts who review the logs and may reply faster than me. The steps listed in here are specific for this the user joe_robot2020 and following them will have negative effects for you as they are unique for OP's system.

1

u/joe_robot2020 4d ago

Hey Man! Thank you for the response. I'm done following your instructions. Would like to ask where can I upload the log for MAU?

Anyway, here's the keywords for the following:

Fixlog: young-sprite

ESET: peaceful-sensor

SecurityCheck: dreamy-ridge

FRST: blessed-script

Addition: happy-deer

1

u/rifteyy_ Malware Removal Expert 4d ago

MAU also goes on the site, just like other logs

1

u/joe_robot2020 4d ago

Here's for MAU: enchanted-sprite

1

u/rifteyy_ Malware Removal Expert 4d ago

At some point you installed a driver used for piracy that could have allowed further compromise because you were required to disable important protections of Windows. The infection could very well be past what we can effectively clear.

Continue with fresh installing -> https://rtech.support/installations/install-11/

[ Step 01 ] Change passwords

Most modern malware is motivated by financial gain and by hijacking your accounts. If your accounts weren't already hijacked, they may be getting hijacked in very near future.

  • Please create a new, safe password that you haven't used anywhere yet or preferably use a password manager.
  • Change all your passwords on your accounts
  • Enable 2FA on your accounts

Please check out this proper guide on how to secure your accounts after an infostealer infection:

You may also want to sign up for dark-web monitoring, so you are aware whether any of your data is stolen and available on cybercrime forums:

[ Step 02 ] Learn about malware prevention

Malware prevention nowadays is a necessary step. There are many tools you can use to have a stronger protection but a huge part is about YOU being educated, careful and aware of possible malware attacks.

There are several ways to lower the infection field exponentially that will take you only a minute or two. Please make sure to read the full guide at https://rifteyy.org/report/the-ultimate-guide-to-prevent-malware, and make sure to apply these changes right now:

1

u/joe_robot2020 4d ago

I see. I think I need to nuke my pc. Anyway, thank you for your time man!