[RezTor]

Hello! I opened up a thread on another forum two days ago and I got directed to this website and I really like the support and help a person like me can get here. I got into a fight with a person online and then we ended up arguing about some [bleep] and he got really pissed off and threated to RAT / Keylogger me and do alot of harsh things to my computer, I never really took him seriously but now I got more and more serious with this and I really want to be sure that I don't have any bad files on my computer. I followed the "Malware and Spyware Cleaning Guide" and it told me to scan my computer with a program called "Farbar Recovery Scan Tool" and I got two logs from there saved on my desktop.

Logs

FRST
http://pastebin.com/TmvUBSJL

Addition
http://pastebin.com/Fc9i9XPB

[Advertisements]

I noticed that every member on this forum did just copy and paste the logs into the thread, should I do that or do you trust my link where I uploaded the log files to?

[RezTor]

I noticed that every member on this forum did just copy and paste the logs into the thread, should I do that or do you trust my link where I uploaded the log files to?

[BrianDrab]

Hi and sorry for the delay. There are signs in your logs of an illegal version of Microsoft Office and/or Microsoft Windows. Our Terms of Use  that I have to abide by prohibits me from assisting unless the illegal software is removed. If you need assistance, please remove any illegal software and then post fresh logs. If you are unaware of any illegal software please let me know that as well.

 

Thank you.

[RezTor]

Hi and sorry for the delay. There are signs in your logs of an illegal version of Microsoft Office and/or Microsoft Windows. Our Terms of Use  that I have to abide by prohibits me from assisting unless the illegal software is removed. If you need assistance, please remove any illegal software and then post fresh logs. If you are unaware of any illegal software please let me know that as well.

 

Thank you.

I have not been aware of it and I have no idea what you really mean that I have on my computer, which apparently should be illegal? If you could help me to solve this problem, I would have been happy. And thank you for replying now. 

EDIT: I bought this computer online and I got it shipped to my house, one year ago and I have not been aware that I have something illegal on my computer? Can this result in something bad? 

Edited by Phifen, 14 May 2015 - 03:23 PM.

[BrianDrab]

Thanks for providing that information. It looked like you had a cracked version of Microsoft Office on your computer a couple months ago but possibly has been removed by now.

 

I've reviewed your logs and can confirm you are clean. I wouldn't take what the person said seriously. To be extra sure, please run the following three scans.

 

Step#1 - JRT
1. Download Junkware Removal Tool to your desktop.
1. Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
2. The tool will open and start scanning your system.
3. Please be patient as this can take a while to complete depending on your system's specifications.
4. On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
5. Close the text file and reboot your machine.
6. Post the contents of JRT.txt into your next message.

 

Step#2 - AdWCleaner
1. Please download AdwCleaner by Xplode onto your desktop.
2. Close all open programs and internet browsers.
3. Right-click on AdwCleaner.exe and select Run as administrator to run the tool.
4. Click on Scan.
5. After the scan is complete click on "Cleaning"
6. Confirm each time with Ok.
7. Your computer will be rebooted automatically. A text file will open after the restart.
8. Please post the content of that logfile with your next answer.
9. If need be, you can also find the logfile at C:\AdwCleaner\AdwCleaner[S0].txt as well.

 

Step#3 - ESET Online Scanner and Post Results
Before running this scan, please temporarily disable your antivirus software to avoid conflicts. You can re-enable once it's done. Instructions for doing this on many AVs are here. This scan can take hours to run but is necessary to ensure we don't miss anything. Plan accordingly.

 

• Please go here and click on
• Note: This site is optimized for Internet Explorer. Please use it for this scan. If you wish to use Firefox or Chrome you will be asked to download the ESET Smart Installer first (esetsmartinstaller_enu.exe). Go ahead and download and run this file.
• Please accept the ESET Online Scanner EULA and click Start.
• If prompted, allow the Add-On/Active X to install. If you have problems with this step please see this link.
• Make sure Enable detection of potentially unwanted applications is selected.
• Click the Advanced Settings link.
• Make sure Remove found threats is NOT checked.
• Make sure Scan archives IS checked.
• Make sure Scan for potentially unsafe applications IS checked.
• Make sure Enable Anti-Stealth technology IS checked
• 
   
• Click on Start
• The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed, if anything was detected please click the List of found threats link.
• 
   
• Then click the Copy to Clipboard link and paste this information into your next reply.
• 

   

   

• Then you may click the Back button.
• Check Uninstall Application on Close before clicking finish.

 
Items for your next post
1. Contents of the ESET log file

 

 

 

Items for your next post

1. Junkware log

2. Adwcleaner log

3. ESET scan

 

[BrianDrab]

I also wanted to warn you about the following.

 

Warnings
The Dangers of P2P Programs
IMPORTANT: I noticed that you have a P2P (Peer to Peer) file sharing program on your computer. I cannot stress highly enough the danger in using these types of programs. P2P programs are one of the major avenues of infection these days. The files downloaded with these programs are more than likely infected with trojans, malware, rootkits, etc.
You run the risk of getting an infection that can compromise your sensitive data, such as financial records, personal information, etc. That is just the infection aspect of using P2P programs. You also run the risk of possible arrest, fines, or in severe cases, jail time for illegal downloading of copyrighted material.
 
Here are some information sources about the dangers of P2P programs:
FBI - Peer to Peer Scams
USA Today Artticle on P2P Programs
File Sharing Infects 500,000 Computers
 
I very much recommend you uninstall this program from your machine. If not, you will likely be back needing help with your machine again. The risks of infections from content downloaded with P2P programs far outweigh any benefit of using them.
 
It is, of course, your choice as to whether or not you remove the program from your machine. It is my duty though, to point out how dangerous it is to use these programs. However, I must request that you do not use it while we are cleaning your machine.
 
Please uninstall the following Peer-to-Peer program(s): qBittorrent 3.1.12

[RezTor]

Thanks for providing that information. It looked like you had a cracked version of Microsoft Office on your computer a couple months ago but possibly has been removed by now.
 
I've reviewed your logs and can confirm you are clean. I wouldn't take what the person said seriously. To be extra sure, please run the following three scans.
 
Step#1 - JRT1. Download Junkware Removal Tool to your desktop.
1. Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
2. The tool will open and start scanning your system.
3. Please be patient as this can take a while to complete depending on your system's specifications.
4. On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
5. Close the text file and reboot your machine.
6. Post the contents of JRT.txt into your next message.
 
Step#2 - AdWCleaner
1. Please download AdwCleaner by Xplode onto your desktop.
2. Close all open programs and internet browsers.
3. Right-click on AdwCleaner.exe and select Run as administrator to run the tool.
4. Click on Scan.
5. After the scan is complete click on "Cleaning"
6. Confirm each time with Ok.
7. Your computer will be rebooted automatically. A text file will open after the restart.
8. Please post the content of that logfile with your next answer.
9. If need be, you can also find the logfile at C:\AdwCleaner\AdwCleaner[S0].txt as well.
 
Step#3 - ESET Online Scanner and Post Results
Before running this scan, please temporarily disable your antivirus software to avoid conflicts. You can re-enable once it's done. Instructions for doing this on many AVs are here. This scan can take hours to run but is necessary to ensure we don't miss anything. Plan accordingly.
 

• Please go here and click on
• Note: This site is optimized for Internet Explorer. Please use it for this scan. If you wish to use Firefox or Chrome you will be asked to download the ESET Smart Installer first (esetsmartinstaller_enu.exe). Go ahead and download and run this file.
• Please accept the ESET Online Scanner EULA and click Start.
• If prompted, allow the Add-On/Active X to install. If you have problems with this step please see this link.
• Make sure Enable detection of potentially unwanted applications is selected.
• Click the Advanced Settings link.
• Make sure Remove found threats is NOT checked.
• Make sure Scan archives IS checked.
• Make sure Scan for potentially unsafe applications IS checked.
• Make sure Enable Anti-Stealth technology IS checked
• 
   
• Click on Start
• The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed, if anything was detected please click the List of found threats link.
• 
   
• Then click the Copy to Clipboard link and paste this information into your next reply.
• 
   
   
  
• Then you may click the Back button.
• Check Uninstall Application on Close before clicking finish.

 Items for your next post
1. Contents of the ESET log file
 
 
 
Items for your next post
1. Junkware log
2. Adwcleaner log
3. ESET scan

I'm doing the last scan right now with ESET and two infected files have been found already and the scan is at 50%, bad luck for me I guess. As soon as the scan are done then I will post the log files in here it will take a few minutes more till its done.

I also wanted to warn you about the following.
 
WarningsThe Dangers of P2P ProgramsIMPORTANT: I noticed that you have a P2P (Peer to Peer) file sharing program on your computer. I cannot stress highly enough the danger in using these types of programs. P2P programs are one of the major avenues of infection these days. The files downloaded with these programs are more than likely infected with trojans, malware, rootkits, etc.
You run the risk of getting an infection that can compromise your sensitive data, such as financial records, personal information, etc. That is just the infection aspect of using P2P programs. You also run the risk of possible arrest, fines, or in severe cases, jail time for illegal downloading of copyrighted material.
 Here are some information sources about the dangers of P2P programs:FBI - Peer to Peer ScamsUSA Today Artticle on P2P ProgramsFile Sharing Infects 500,000 Computers
 
I very much recommend you uninstall this program from your machine. If not, you will likely be back needing help with your machine again. The risks of infections from content downloaded with P2P programs far outweigh any benefit of using them.
 
It is, of course, your choice as to whether or not you remove the program from your machine. It is my duty though, to point out how dangerous it is to use these programs. However, I must request that you do not use it while we are cleaning your machine.
 
Please uninstall the following Peer-to-Peer program(s): qBittorrent 3.1.12

I'm aware of this program but believe it or not but my friend that helped me with my computer referred me to that instead of uTorrent, I needed it to download Winrar, I will follow your advice and uninstall it right after the scan is done. Do you think uTorrent is better to use? I don't download anything to my computer I use it as a hobby to play games with my closest friends after a hard day at my job.

[RezTor]

All three scans are done now.

AdwCleaner log file:

# AdwCleaner v4.203 - Logfile created 15/05/2015 at 01:26:47

# Updated 30/04/2015 by Xplode

# Database : 2015-05-12.2 [Server]

# Operating system : Windows 8.1 Enterprise  (x64)

# Username : --- - ---

# Running from : C:\Users\---\Desktop\adwcleaner_4.203.exe

# Option : Cleaning

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

 

***** [ Scheduled tasks ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

 

***** [ Web browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17416

 

 

-\\ Mozilla Firefox v38.0 (x86 sv-SE)

 

 

-\\ Google Chrome v42.0.2311.152

 

 

*************************

 

AdwCleaner[R0].txt - [1758 bytes] - [05/05/2015 09:18:58]

AdwCleaner[R1].txt - [846 bytes] - [05/05/2015 09:30:43]

AdwCleaner[R2].txt - [952 bytes] - [15/05/2015 00:42:02]

AdwCleaner[R3].txt - [1069 bytes] - [15/05/2015 01:26:18]

AdwCleaner[S0].txt - [1630 bytes] - [05/05/2015 09:21:47]

AdwCleaner[S1].txt - [1011 bytes] - [15/05/2015 00:43:37]

AdwCleaner[S2].txt - [996 bytes] - [15/05/2015 01:26:47]

 

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1054  bytes] ##########

ESET log file:

C:\AdwCleaner\Quarantine\C\Program Files\FileViewPro\FileViewPro.exe.vir MSIL/Solvusoft.A potentially unwanted application

C:\Users\---\Documents\My Filehippo Downloads\ccsetup505.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

JRT log file:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.7.1 (05.14.2015:1)

OS: Windows 8.1 Enterprise x64

Ran by --- on 2015-05-15 at  0:37:02,61

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

~~~ Services

 

 

 

~~~ Tasks

 

Successfully deleted: [Task] C:\Windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-1074318490-935556695-2257036404-1001

 

 

 

~~~ Registry Values

 

 

 

~~~ Registry Keys

 

 

 

~~~ Files

 

 

 

~~~ Folders

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 2015-05-15 at  0:38:56,68

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[RezTor]

I also wanted to warn you about the following.

 

Warnings
The Dangers of P2P Programs
IMPORTANT: I noticed that you have a P2P (Peer to Peer) file sharing program on your computer. I cannot stress highly enough the danger in using these types of programs. P2P programs are one of the major avenues of infection these days. The files downloaded with these programs are more than likely infected with trojans, malware, rootkits, etc.
You run the risk of getting an infection that can compromise your sensitive data, such as financial records, personal information, etc. That is just the infection aspect of using P2P programs. You also run the risk of possible arrest, fines, or in severe cases, jail time for illegal downloading of copyrighted material.
 
Here are some information sources about the dangers of P2P programs:
FBI - Peer to Peer Scams
USA Today Artticle on P2P Programs
File Sharing Infects 500,000 Computers
 
I very much recommend you uninstall this program from your machine. If not, you will likely be back needing help with your machine again. The risks of infections from content downloaded with P2P programs far outweigh any benefit of using them.
 
It is, of course, your choice as to whether or not you remove the program from your machine. It is my duty though, to point out how dangerous it is to use these programs. However, I must request that you do not use it while we are cleaning your machine.
 
Please uninstall the following Peer-to-Peer program(s): qBittorrent 3.1.12

qBittorrent is now uninstalled. Thanks for letting me now! 

[BrianDrab]

Everything looks good. If there is nothing else, I'll leave you with the following.

 

OK! Well done, your computer is clean again! Part of our jobs here at G2G is to help you clean your computer. But beyond that and just as important is to provide you with some information to keep you safe and secure on the net as well as to share knowledge. Following is that information.
 
1. Clean Up!
We need to remove all the tools that we used so that should you ever be re-infected, you will download updated versions which may have updated detection logic.
1. Download Delfix from here.
2. Ensure everything is checked.
3. Click Run.
Note: The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply.
Note: Delete any  other .bat, .log, .reg, .txt,  and any other files created during this process, and left on the desktop and empty the Recycle Bin.
 
 
2. Keeping Programs Updated
You need to ensure that any programs installed on your machine are kept current. The bad guys exploit vulnerabilities that are found in older versions of software. A very good piece of software that keeps your programs up-to-date is Secunia Personal Software Inspector (PSI). You can download and install it from here. You can read more information about this free software as well as a video walkthrough from here.
 
3. Antimalware- Preventative
Note: Let's keep Malwarebytes installed as it's a fantastic piece of software. Malwarebytes is an anti-malware software and not an antivirus software so it won't conflict with the Antivirus that you are running. I would recommend that you open up this program, allow it to update and scan your machine at least quarterly...monthly if you can.
 
4. Crypto Warning!!!! - Complete Data Loss can occur!
There are particularly nasty infections out there at the moment that encrypt your data and hold it for ransom. You may read more about this here.
 

• Download CryptoPrevent free for home use here following the instructions below.
• Save the file to your desktop from the link above and then open the program by clicking Run when prompted from your browser or by going to the desktop where the file was saved and double-clicking.
• Accept all the defaults during the install. The last screen of the install has a checkmark in "Launch CryptoPrevent". This is good and will launch the program once you click Finish.
• You will get a prompt asking if you purchased a Product Key for Automatic Updates. You can answer No.
• You will then be prompted to learn more about automatic updates or if you want to purchase a key. This is up to you but you don't have to.
• You will be prompted to click OK to continue and select your protection level. Go ahead and click OK.
• Click the Apply button to set Default protection.
• You may get a message stating that Windows Sidebar and Desktop Gadgets are a major security vulnerability and asking you if you want to disable them. If you don't use these features, answer Yes.
• That's it. The protection is in place.

Note: The free version doesn't provide automatic updates. Periodically, you should open up the program (there is a shortcut on your desktop now) and select the Updates! menu....and select Check for Updates to see if there are any as this infection has serious consequences.
 

 

 

 
 
For more information about computer security and how to protect yourself when on the internet, please read this guide Best Practices for Safe Computing
 
OK, all the best, and stay safe!
 
Items for your next post
1. Contents of the delfix log

[RezTor]

Everything looks good. If there is nothing else, I'll leave you with the following.

 

OK! Well done, your computer is clean again! Part of our jobs here at G2G is to help you clean your computer. But beyond that and just as important is to provide you with some information to keep you safe and secure on the net as well as to share knowledge. Following is that information.
 
1. Clean Up!
We need to remove all the tools that we used so that should you ever be re-infected, you will download updated versions which may have updated detection logic.
1. Download Delfix from here.
2. Ensure everything is checked.
3. Click Run.
Note: The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply.
Note: Delete any  other .bat, .log, .reg, .txt,  and any other files created during this process, and left on the desktop and empty the Recycle Bin.
 
 
2. Keeping Programs Updated
You need to ensure that any programs installed on your machine are kept current. The bad guys exploit vulnerabilities that are found in older versions of software. A very good piece of software that keeps your programs up-to-date is Secunia Personal Software Inspector (PSI). You can download and install it from here. You can read more information about this free software as well as a video walkthrough from here.
 
3. Antimalware- Preventative
Note: Let's keep Malwarebytes installed as it's a fantastic piece of software. Malwarebytes is an anti-malware software and not an antivirus software so it won't conflict with the Antivirus that you are running. I would recommend that you open up this program, allow it to update and scan your machine at least quarterly...monthly if you can.
 
4. Crypto Warning!!!! - Complete Data Loss can occur!
There are particularly nasty infections out there at the moment that encrypt your data and hold it for ransom. You may read more about this here.
 

• Download CryptoPrevent free for home use here following the instructions below.
• Save the file to your desktop from the link above and then open the program by clicking Run when prompted from your browser or by going to the desktop where the file was saved and double-clicking.
• Accept all the defaults during the install. The last screen of the install has a checkmark in "Launch CryptoPrevent". This is good and will launch the program once you click Finish.
• You will get a prompt asking if you purchased a Product Key for Automatic Updates. You can answer No.
• You will then be prompted to learn more about automatic updates or if you want to purchase a key. This is up to you but you don't have to.
• You will be prompted to click OK to continue and select your protection level. Go ahead and click OK.
• Click the Apply button to set Default protection.
• You may get a message stating that Windows Sidebar and Desktop Gadgets are a major security vulnerability and asking you if you want to disable them. If you don't use these features, answer Yes.
• That's it. The protection is in place.

Note: The free version doesn't provide automatic updates. Periodically, you should open up the program (there is a shortcut on your desktop now) and select the Updates! menu....and select Check for Updates to see if there are any as this infection has serious consequences.
 

 

 

 
 
For more information about computer security and how to protect yourself when on the internet, please read this guide Best Practices for Safe Computing
 
OK, all the best, and stay safe!
 
Items for your next post
1. Contents of the delfix log

I did the scan now. Thank you really much for taking your time to help me! 

Delfix log:

Deleted : C:\RegBackup

Deleted : C:\Users\---\Desktop\adwcleaner_4.203.exe

Deleted : C:\Users\---\Desktop\FRST64.exe

Deleted : C:\Users\---\Desktop\JRT.exe

Deleted : C:\Users\---\Desktop\JRT.txt

Deleted : C:\Users\---\Desktop\Rkill.txt

Deleted : HKLM\SOFTWARE\AdwCleaner

 

~ Creating registry backup ... OK

 

~ Cleaning system restore ...

 

Deleted : RP #31 [Installed Ginger | 05/09/2015 10:34:15]

Deleted : RP #32 [Windows Update | 05/13/2015 16:15:07]

Deleted : RP #33 [Removed Asmedia USB Host Controller Driver. | 05/14/2015 19:34:51]

Deleted : RP #34 [Quick Restore Maker Generated | 05/14/2015 20:33:42]

 

New restore point created !

 

~ Resetting system settings ... OK

 

########## - EOF - ##########

Edited by Phifen, 14 May 2015 - 05:56 PM.

[RezTor]

Do you have a chance to answer my question I asked in my last thread I started, but you decided to close. I have not found any information about this topic anywhere on this forum so it's probably best to ask you because you are so knowledgeable on the subject, how should I replace my current firewall with a new one and how should I uninstall my firewall that I use right now? What will happen after that and how do I go about getting my new firewall work correctly? Once again BrainDrab thank you for helping me with all this, I can't explain how happy I am right now! 

[BrianDrab]

Do you have a chance to answer my question I asked in my last thread I started, but you decided to close.

 

I don't think I closed your other topic. I believe one of the other staff saw that I was already helping you so suggested that you ask here.

 

When it comes to Firewalls there are hardware firewalls that you can purchase and Software firewalls. Windows 8 comes with a decent firewall for most users. It's secure and unobtrusive. When you get into 3rd party firewalls they can become problematic for you as they take constant attention. You need to designate what is allowed and what isn't and tweak it anytime you install a new program. If you're really committed to putting the effort into getting a firewall configured and maintained then by all means you can. There are so many firewalls out there...some dedicated to being a firewall, some that share the responsibility with the Antivirus, etc.

 

One example of a free firewall that I've recommended in the past is Outpost.

 

To be honest, any more detail is a little out of my knowledge area. If you need more information than I provided here then you may want to post a topic in our Applications forum as the techs there are much more knowledgeable on such things. My specialty is really malware removal.

 

I hope this helps. Take care.

[RezTor]

 

Do you have a chance to answer my question I asked in my last thread I started, but you decided to close.

 

I don't think I closed your other topic. I believe one of the other staff saw that I was already helping you so suggested that you ask here.

 

When it comes to Firewalls there are hardware firewalls that you can purchase and Software firewalls. Windows 8 comes with a decent firewall for most users. It's secure and unobtrusive. When you get into 3rd party firewalls they can become problematic for you as they take constant attention. You need to designate what is allowed and what isn't and tweak it anytime you install a new program. If you're really committed to putting the effort into getting a firewall configured and maintained then by all means you can. There are so many firewalls out there...some dedicated to being a firewall, some that share the responsibility with the Antivirus, etc.

 

One example of a free firewall that I've recommended in the past is Outpost.

 

To be honest, any more detail is a little out of my knowledge area. If you need more information than I provided here then you may want to post a topic in our Applications forum as the techs there are much more knowledgeable on such things. My specialty is really malware removal.

 

I hope this helps. Take care.

 

This is the firewall I've been thinking about switching to and I got the offer from this forum and an administrator suggested this particular firewall because it was better than usual, and it was free, no additional costs. I'll check out this section of the forum and I'll see if I decide to change firewall but it will probably be a change just because I want myself as protected as possible and not have to be a part of this threats again. Thank you for your time BrianDrab and for all the support you have given me. May I wish you luck and have a great summer. 

[BrianDrab]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.