ckbeme Posted November 3, 2016 ID:1070127 Share Posted November 3, 2016 I was hacked in August 2016, got help from another forum and thought it cleaned desktop. When we thought my data was clean, AND Windows 10 Pro, I did 3 backups, formatted hard drive, and did clean Windows install. My backup drive failed, so I've spent the last 2 months trying to recover my data. That was ALL my important data. Recently I noticed my new USB wifi adapter showed Network Type: Access Point, and I said NO during setup to use it as access point. Don't know if that's why, but I ran First.exe today and found 2 of the same files that were in the First.txt and Addition.txt in August. I don't know how access points work, but I'm thinking since I didn't do anything to secure an AP, anyone could get into my PC. Do you guys have to accept my request for assistance, then you ask me to submit files? I can't find anything on the forum that tells if we submit data on first post. Thanks for any help. ckbeme Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted November 3, 2016 ID:1070131 Share Posted November 3, 2016 Hello, Please attach FRST reports. Link to post Share on other sites More sharing options...
ckbeme Posted November 5, 2016 Author ID:1070402 Share Posted November 5, 2016 Hi Twin, thanks for your quick response. I have * in both of my attached reports. I deleted the C:\ProgramData\sdpsenv.dat file that was found when I ran Frst.exe and I hope that doesn't screw you up. It was a knee jerk response, because I knew that file was on my PC before the cleanup in August. Promise I won't misbehave again. Addition.txt FRST.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted November 5, 2016 ID:1070507 Share Posted November 5, 2016 Fix with Farbar Recovery Scan Tool This fix was created for this user for use on that particular machine. Running it on another one may cause damage and render the system unstable. Download attached fixlist.txt file and save it to the Desktop: Both files, FRST and fixlist.txt have to be in the same location or the fix will not work! Right-click on icon and select Run as Administrator to start the tool. (XP users click run after receipt of Windows Security Warning - Open File). Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finishes FRST will generate a log on the Desktop, called Fixlog.txt. Please attach it to your reply. fixlist.txt Link to post Share on other sites More sharing options...
ckbeme Posted November 5, 2016 Author ID:1070622 Share Posted November 5, 2016 here ya go Fixlog.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted November 6, 2016 ID:1070678 Share Posted November 6, 2016 How is the situation now? Link to post Share on other sites More sharing options...
ckbeme Posted November 6, 2016 Author ID:1070719 Share Posted November 6, 2016 Well, it's a bit early to say. I just got home and I just turned on my desktop. Did you find only minor issues? Because when I was hacked in July, the guy that helped me said I had a backdoor trojan. And he had me run several programs that created reports that he reviewed. And can you tell me what you found? Thanks Link to post Share on other sites More sharing options...
ckbeme Posted November 6, 2016 Author ID:1070721 Share Posted November 6, 2016 And that file C:\ProgramData\sdpsenv.dat that FRST found again on this go around - was an indicator that you probably have several severe, tough malware and trojans on your system. (so he said) Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted November 6, 2016 ID:1070740 Share Posted November 6, 2016 Yes, I did find only minor issues. That file you are mentioning is related to GPSoftware Directory Opus application. Link to post Share on other sites More sharing options...
ckbeme Posted November 6, 2016 Author ID:1070750 Share Posted November 6, 2016 sdpsenv.dat - This file is related to Opus? Well can I ask you this - does that mean the hackers infected that program? And can you tell me what the heck I can do to prevent another attack? After the July one, I changed and hid my SSID, changed passwords on wifi and router, changed my External IP address. I have ESET Smart Security w/Firewall, Windows Firewall, and my Netgear Router has firewall. I don't go to pirate sites, I don't use any social networks, I just don't believe this happened again. Do you know of anyway I can find out who (what IP address) hacked me? Or do you know of a list of ports that are known to be evil - then I can block them in my firewall(s), Or any ideas how I can protect myself? I still haven't recovered from the July hack. And when the other guy helped me with the July hack, I told him I couldn't clean the laptop for awhile. I need my desktop. The laptop is merely a convenience. But I'm to the point now, since my backup drive failed and I'm missing so much data, I can get some of it from the laptop. So would you be willing to give it a go? Or do I need to create a new post? Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted November 7, 2016 ID:1070818 Share Posted November 7, 2016 No, they did not infect this program, it is creating this file because it needs it. I don't see any malware and I don't see any sign that you were hacked. Since there is no malware on your machine if you need additional help or advice, I suggest to open new topic here: https://forums.malwarebytes.org/forum/6-general-windows-pc-help/ Link to post Share on other sites More sharing options...
Recommended Posts