Slyfur Posted September 4, 2018 ID:1267599 Share Posted September 4, 2018 I've tried to remove trojan.rorracoon using malwarebytes but it didnt seem to work ive tried three times already and it popped up six times on my quarantine. Im a newbie at using a computer but can you please help me. Link to post Share on other sites More sharing options...
Slyfur Posted September 4, 2018 Author ID:1267600 Share Posted September 4, 2018 Nothing suspicious has popped up either, no pop up adds, and the web slowing down Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 5, 2018 Root Admin ID:1267722 Share Posted September 5, 2018 Hello @Slyfur and Please run the following steps and post back the logs as an attachment when ready.STEP 01 If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. If you don't have Malwarebytes 3 installed yet please download it from here and install it. Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply. If Malwarebytes won't run then please skip to the next step and let me know on your next reply. STEP 02 Please download AdwCleaner by Malwarebytes and save the file to your Desktop. Right-click on the program and select Run as Administrator to start the tool. Accept the Terms of use. Wait until the database is updated. Click Scan. When finished, please click Clean. Your PC should reboot now if any items were found. After reboot, a log file will be opened. Copy its content into your next reply. RESTART THE COMPUTER Before running Step 3 STEP 03 Please download the Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens, click Yes to disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here. Please attach the Additions.txt log to your reply as well. Thanks Ron Link to post Share on other sites More sharing options...
Slyfur Posted September 5, 2018 Author ID:1267842 Share Posted September 5, 2018 Malwarebytes scan.txt # ------------------------------- # Malwarebytes AdwCleaner 7.2.3.1 # ------------------------------- # Build: 09-03-2018 # Database: 2018-09-05.1 (Cloud) # Support: https://www.malwarebytes.com/support # # ------------------------------- # Mode: Scan # ------------------------------- # Start: 09-05-2018 # Duration: 00:00:11 # OS: Windows 7 Ultimate # Scanned: 41877 # Detected: 0 ***** [ Services ] ***** No malicious services found. ***** [ Folders ] ***** No malicious folders found. ***** [ Files ] ***** No malicious files found. ***** [ DLL ] ***** No malicious DLLs found. ***** [ WMI ] ***** No malicious WMI found. ***** [ Shortcuts ] ***** No malicious shortcuts found. ***** [ Tasks ] ***** No malicious tasks found. ***** [ Registry ] ***** No malicious registry entries found. ***** [ Chromium (and derivatives) ] ***** No malicious Chromium entries found. ***** [ Chromium URLs ] ***** No malicious Chromium URLs found. ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries found. ***** [ Firefox URLs ] ***** No malicious Firefox URLs found. AdwCleaner[S00].txt - [1971 octets] - [04/09/2018 14:59:33] AdwCleaner[C00].txt - [1991 octets] - [04/09/2018 14:59:55] AdwCleaner[S01].txt - [1375 octets] - [04/09/2018 15:05:12] AdwCleaner[S02].txt - [1436 octets] - [04/09/2018 15:39:13] AdwCleaner[S03].txt - [1497 octets] - [04/09/2018 15:40:17] ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S04].txt ##########Addition.txt FRST.txt Link to post Share on other sites More sharing options...
Slyfur Posted September 5, 2018 Author ID:1267844 Share Posted September 5, 2018 When i ran adwcleaner it failed to reboot even though it said nothing was detected. After i was done restarting homegroup appeared as a shortcut Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 5, 2018 Root Admin ID:1267852 Share Posted September 5, 2018 (edited) Why are you launching Steam from this folder on your desktop? C:\Users\Administrator\Desktop\New folder\steam.exe [3207968 2018-08-29] (Valve Corporation) It should be running from the installation in this folder: C:\Program Files\Steam It looks like you're trying to run some type of cheat against Steam? S3 EQU8_tabg; C:\Users\Administrator\Desktop\New folder\steamapps\common\TotallyAccurateBattlegrounds\TotallyAccurateBattlegrounds_Data\Plugins\agent.x64.equ8.exe [3444216 2018-07-05] (Int3 Software AB) Edited September 5, 2018 by AdvancedSetup Link to post Share on other sites More sharing options...
Slyfur Posted September 5, 2018 Author ID:1267853 Share Posted September 5, 2018 (edited) I thought it just stored game data, but anyways is there any way to get rid of trojan or should i run another scan? And im not running a cheat or hack against steam Edited September 5, 2018 by Slyfur Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 5, 2018 Root Admin ID:1267857 Share Posted September 5, 2018 The tool, program from the actual vendor and run from their real installed folders should be okay. Running from your desktop like that is not valid. I'll write a script to clean and remove. If you have issues with your games please reinstall Steam to the correct location, directly from Steam not some other site on the Web Link to post Share on other sites More sharing options...
Slyfur Posted September 5, 2018 Author ID:1267859 Share Posted September 5, 2018 Thank you, but im more concerned about the virus atm please tell me you can remove it Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 5, 2018 Root Admin ID:1267860 Share Posted September 5, 2018 There is no virus. There is a Trojan. We will get it removed. Link to post Share on other sites More sharing options...
Slyfur Posted September 5, 2018 Author ID:1267861 Share Posted September 5, 2018 (edited) I see, thank you. And im sorry if i may have came across as rude. I've been stressed out for the past two days. Edited September 5, 2018 by Slyfur Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 5, 2018 Root Admin ID:1267863 Share Posted September 5, 2018 Please run the following fix. It will also create a new zip file on your desktop that I'd like to get back. The zip file will have a Date and Time on it with the date and time it was created Date_Time.zip please upload that on your next reply too. Please download the attached fixlist.txt file and save it to the Desktop.NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system. Run FRST or FRST64 and press the Fix button just once and wait. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. fixlist.txt Thanks Ron Link to post Share on other sites More sharing options...
Slyfur Posted September 5, 2018 Author ID:1267864 Share Posted September 5, 2018 Sorry but im a bit confused where do i run the fix? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 5, 2018 Root Admin ID:1267865 Share Posted September 5, 2018 You download the attached file above. Then copy it to the same place where you have the FRST64.EXE program. Currently: C:\Users\Administrator\Downloads With both files in the same folder you just click the Fix button in FRST and it will run the fix automatically Link to post Share on other sites More sharing options...
Slyfur Posted September 5, 2018 Author ID:1267867 Share Posted September 5, 2018 (edited) 05.09.2018_16.18.11.zip I ran the fix, but how do i know if the fix really worked? And here's your datetime zip. Should i delete it after you've received the file? Edited September 5, 2018 by Slyfur Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 5, 2018 Root Admin ID:1267868 Share Posted September 5, 2018 Thanks. You can delete the zip file now. Let's go ahead and run all new scans again please. Please run the following steps and post back the logs as an attachment when ready.STEP 01 If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. If you don't have Malwarebytes 3 installed yet please download it from here and install it. Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply. If Malwarebytes won't run then please skip to the next step and let me know on your next reply. STEP 02 Please download AdwCleaner by Malwarebytes and save the file to your Desktop. Right-click on the program and select Run as Administrator to start the tool. Accept the Terms of use. Wait until the database is updated. Click Scan. When finished, please click Clean. Your PC should reboot now if any items were found. After reboot, a log file will be opened. Copy its content into your next reply. RESTART THE COMPUTER Before running Step 3 STEP 03 Please download the Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens, click Yes to disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here. Please attach the Additions.txt log to your reply as well. Thanks Ron Link to post Share on other sites More sharing options...
Slyfur Posted September 5, 2018 Author ID:1267871 Share Posted September 5, 2018 2nd malwarebyte scan.txt # ------------------------------- # Malwarebytes AdwCleaner 7.2.3.1 # ------------------------------- # Build: 09-03-2018 # Database: 2018-09-05.1 (Cloud) # Support: https://www.malwarebytes.com/support # # ------------------------------- # Mode: Scan # ------------------------------- # Start: 09-05-2018 # Duration: 00:00:11 # OS: Windows 7 Ultimate # Scanned: 41877 # Detected: 0 ***** [ Services ] ***** No malicious services found. ***** [ Folders ] ***** No malicious folders found. ***** [ Files ] ***** No malicious files found. ***** [ DLL ] ***** No malicious DLLs found. ***** [ WMI ] ***** No malicious WMI found. ***** [ Shortcuts ] ***** No malicious shortcuts found. ***** [ Tasks ] ***** No malicious tasks found. ***** [ Registry ] ***** No malicious registry entries found. ***** [ Chromium (and derivatives) ] ***** No malicious Chromium entries found. ***** [ Chromium URLs ] ***** No malicious Chromium URLs found. ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries found. ***** [ Firefox URLs ] ***** No malicious Firefox URLs found. AdwCleaner[S00].txt - [1971 octets] - [04/09/2018 14:59:33] AdwCleaner[C00].txt - [1991 octets] - [04/09/2018 14:59:55] AdwCleaner[S01].txt - [1375 octets] - [04/09/2018 15:05:12] AdwCleaner[S02].txt - [1436 octets] - [04/09/2018 15:39:13] AdwCleaner[S03].txt - [1497 octets] - [04/09/2018 15:40:17] ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S04].txt ########## FRST.txt Addition.txt Link to post Share on other sites More sharing options...
Slyfur Posted September 5, 2018 Author ID:1267872 Share Posted September 5, 2018 I still see the trojan in the scan did i do something wrong? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 5, 2018 Root Admin ID:1267874 Share Posted September 5, 2018 Please run the following and post back the log Link to post Share on other sites More sharing options...
Slyfur Posted September 5, 2018 Author ID:1267878 Share Posted September 5, 2018 It finished scanning and said there was no malware found Link to post Share on other sites More sharing options...
Slyfur Posted September 5, 2018 Author ID:1267882 Share Posted September 5, 2018 3rd malwarebytes scan.txt # ------------------------------- # Malwarebytes AdwCleaner 7.2.3.1 # ------------------------------- # Build: 09-03-2018 # Database: 2018-09-05.1 (Cloud) # Support: https://www.malwarebytes.com/support # # ------------------------------- # Mode: Scan # ------------------------------- # Start: 09-05-2018 # Duration: 00:00:11 # OS: Windows 7 Ultimate # Scanned: 41877 # Detected: 0 ***** [ Services ] ***** No malicious services found. ***** [ Folders ] ***** No malicious folders found. ***** [ Files ] ***** No malicious files found. ***** [ DLL ] ***** No malicious DLLs found. ***** [ WMI ] ***** No malicious WMI found. ***** [ Shortcuts ] ***** No malicious shortcuts found. ***** [ Tasks ] ***** No malicious tasks found. ***** [ Registry ] ***** No malicious registry entries found. ***** [ Chromium (and derivatives) ] ***** No malicious Chromium entries found. ***** [ Chromium URLs ] ***** No malicious Chromium URLs found. ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries found. ***** [ Firefox URLs ] ***** No malicious Firefox URLs found. AdwCleaner[S00].txt - [1971 octets] - [04/09/2018 14:59:33] AdwCleaner[C00].txt - [1991 octets] - [04/09/2018 14:59:55] AdwCleaner[S01].txt - [1375 octets] - [04/09/2018 15:05:12] AdwCleaner[S02].txt - [1436 octets] - [04/09/2018 15:39:13] AdwCleaner[S03].txt - [1497 octets] - [04/09/2018 15:40:17] ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S04].txt ##########FRST.txt Addition.txt Link to post Share on other sites More sharing options...
Slyfur Posted September 5, 2018 Author ID:1267883 Share Posted September 5, 2018 It didnt detect the trojan so i think, im alright. But what should i do about the trojans that are in quarantine, should i delete them from the quarantine? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 5, 2018 Root Admin ID:1267897 Share Posted September 5, 2018 You can leave them in quarantine for a couple weeks. There is no harm in leaving them there. Then if you want you can delete them from quarantine. Let's go ahead though and run one more scan just to make sure all is good. Please download and run the following tool to remove any found threats Kaspersky Virus Removal Tool Let me know if it finds anything or not Ron Link to post Share on other sites More sharing options...
Slyfur Posted September 6, 2018 Author ID:1267908 Share Posted September 6, 2018 Nothing came up, thank you so much for helping me remove them. I'm going to delete them from quarantine once and for and never have to worry about them again. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 6, 2018 Root Admin ID:1267917 Share Posted September 6, 2018 Okay, sounds good. Take care. I'll close your topic now. Cheers Ron Link to post Share on other sites More sharing options...
Recommended Posts