plainpatt Posted December 23, 2015 ID:1008618 Share Posted December 23, 2015 so i been posting similar logs that you guys use here at malware-bytes on other forums to check if my pc is clean and someone mentioned that this file looked suspicious and i uploaded it here, and based on all the info it looks like some type of RAT or Keylogger, but i have no idea. i will post all my logs and link to the file below. mysterious malicious file: (still on my pc as a hidden file.)https://www.reverse.it/sample/9c81b56b4bf892869002494d4fff9239220be884351c106dff32a2e3b2360975?environmentId=2%E2%80%8B FRST.txtAddition.txthijackthis.logmbam-log-2015-12-23 (07-55-02).xml Link to post Share on other sites More sharing options...
kevinf80 Posted December 23, 2015 ID:1008621 Share Posted December 23, 2015 Hello and welcome to Malwarebytes,Please be aware the following P2P/Piracy Warning is a standard opening reply made here at Malwarebytes, we make no accusations but do make you aware of Forum Protocol....If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. Please open Malwarebytes Anti-Malware. On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits". Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button. A Threat Scan will begin. When the scan is complete, click Apply Actions. Wait for the prompt to restart the computer to appear (if applicable), then click on Yes. After the restart once you are back at your desktop, open MBAM once more.To get the log from Malwarebytes do the following: Click on the History tab > Application Logs. Double click on the scan log which shows the Date and time of the scan just performed. Click Export > From export you have three options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… Next, Upload a File to VirustotalGo to http://www.virustotal.com/ Click the Choose file button Navigate to the file C:\Users\patrick\AppData\Roaming\d3dx10.exe Click the Scan it tab If you get a message saying File has already been analyzed: click Reanalyze file now Copy and paste the results back here please. Next, Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs.... Post log from Malwarebytes, FRST and results from VirusTotal... Thank you, Kevin Link to post Share on other sites More sharing options...
plainpatt Posted December 23, 2015 Author ID:1008624 Share Posted December 23, 2015 Hello and welcome to Malwarebytes,Please be aware the following P2P/Piracy Warning is a standard opening reply made here at Malwarebytes, we make no accusations but do make you aware of Forum Protocol.... Please open Malwarebytes Anti-Malware. On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as MalwareClick on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.A Threat Scan will begin.When the scan is complete, click Apply Actions.Wait for the prompt to restart the computer to appear (if applicable), then click on Yes.After the restart once you are back at your desktop, open MBAM once more.To get the log from Malwarebytes do the following:Click on the History tab > Application Logs.Double click on the scan log which shows the Date and time of the scan just performed.Click Export > From export you have three options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to replyPlease use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… Next, Upload a File to VirustotalGo to http://www.virustotal.com/ Click the Choose file buttonNavigate to the file C:\Users\patrick\AppData\Roaming\d3dx10.exeClick the Scan it tabIf you get a message saying File has already been analyzed: click Reanalyze file nowCopy and paste the results back here please. Next, Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs.... Post log from Malwarebytes, FRST and results from VirusTotal... Thank you, Kevinhttps://www.virustotal.com/en/file/9c81b56b4bf892869002494d4fff9239220be884351c106dff32a2e3b2360975/analysis/1450890689/Addition: http://pastebin.com/H84gNVbkFRST: http://pastebin.com/3Zp8BPme Link to post Share on other sites More sharing options...
kevinf80 Posted December 23, 2015 ID:1008626 Share Posted December 23, 2015 Do you have log from Malwarebytes? Also do you know and trust this proxy 54.183.203.161:8080 Link to post Share on other sites More sharing options...
plainpatt Posted December 23, 2015 Author ID:1008627 Share Posted December 23, 2015 Do you have log from Malwarebytes? Also do you know and trust this proxy 54.183.203.161:8080 No i do not know of or trust proxy 54.183.203.161:8080, Malwarebytes Log file: http://pastebin.com/KdhrvMp9 Their are no .txt log files i cant find from malwarebytes. Link to post Share on other sites More sharing options...
plainpatt Posted December 23, 2015 Author ID:1008628 Share Posted December 23, 2015 Do you have log from Malwarebytes? Also do you know and trust this proxy 54.183.203.161:8080is the file from the virusscan malware? how do i get rid of it. Link to post Share on other sites More sharing options...
kevinf80 Posted December 23, 2015 ID:1008631 Share Posted December 23, 2015 Unfortunately you have illegal software on your system, that is a direct breach of forum protocol. I cannot offer any further help. If you do not agree please contact a forum moderator... Thank you, Kevin... Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 25, 2015 Root Admin ID:1008890 Share Posted December 25, 2015 127.0.0.1 validation.sls.microsoft.comTask: {89E1913B-6181-4080-B899-4C26491710BC} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS.exeC:\Windows\AutoKMS.exeTask: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS.exe Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 25, 2015 Root Admin ID:1008891 Share Posted December 25, 2015 This topic will now be closed due to evidence of cracked or pirated software on this system.Piracy Policy Link to post Share on other sites More sharing options...
Recommended Posts