I think i have a RAT on my computer

[oweng12345]

I downloaded a file that didn't trigger the av, but once i went offline my account on discord was sending the same link that i think i was infected with, i don't know if a RAT can work when i'm offline, but i ran a full scan on malwarebytes and it only found generic malware, but i don't know if that has actually removed it.

[oweng12345]

Also on discord where the links were sent, i have two factor authentication and that didn't trigger anything so i'm pretty sure it's a RAT

[Maurice Naggar]

Hi,  @oweng12345     

My name is Maurice. I will be helping and guiding you, going forward on this case.

Just what file did you download?   what is the file-name  and from where did you get it ?

Please know that often folks jump to conclusions about a "RAT" possibility.   There is no mention here of what security software is installed, and what security scans have been done.   And whether Microsoft Windows Updates is fully up to date.

Definition of RAT - - -  Remote administration tool (RAT)   - - -  A software program that allows users to control another system as if they have physical access to it.

Is that really the case?

You mentioned 

Quote

i ran a full scan on malwarebytes and it only found generic malware

I would like to see the scan history of Malwarebytes.    But we also have to run other scans.   We will take one thing at a time.  Patience in all this is a good thing.

We need to get information from this machine in order to have the proper detail to help you forward.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

    Download Malwarebytes Support Tool
    
    
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support-1.4.0.615.exe to run the report
        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
    You will be presented with a page stating, "Get Started!"

    Do NOT use the button “Start repair” !
    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
    Please attach the ZIP file in your next reply.

 

I would suggest that you cease using Discord and playing any online games, or games in general while this case is on-going.

Thank you.

 

 

 

[oweng12345]

it was a discord nitro generator, i know stupid of me to download it, i got it from a trusted discord user which i thought was trusted but they had the same problem as me, they downloaded it from someone else and the same file is being sent around from my discord account when i had gone off discord. I ran this file and it didn't display anything it had disappared from my downloads immediately, but nothing was picked up by windows defender or malwarebytes malware protection. This is my scan history - https://gyazo.com/a841ac7826cf5cd3871e33e52a44c4d3

mbst-grab-results.zip

[Maurice Naggar]

What follows is a first step to have Windows 10 show all files and folder. Do not let this spook you out.

There is a how-to at Tenforums. Use either option one or two or three

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

 

Needless to say, be extremely careful what you download.   First, save and then SCAN anything you download, especially from things like Discord !

By the way, screen grabs of the list in Reports history is not one that is useful.   That screen has no specific detail.

The fact is the last Malwarebytes scan found "Generic.Malware.Suspicious"  in the Temp area on Discord files.

.

Upload that "discord nitro generator" file up to Virustotal for analysis.

Can you please go to Virustotal website  ( which is a site that many security companies use to upload and check files for potential malware.  The site uses multiple search engines from several companies).

Go to the link https://www.virustotal.com/gui/home/upload

You will see Choose file button.   Click that as a first step.   You will then see a dialog grid from Windows.

On the white "File name" box point it to the location of that FILE

 

then click Open button.  It should then Upload a copy of that file.  That file will be analyzed.

Watch the progress.  It should take a short while.

After it has all completed, it will show a completed results page.

Please provide the link address to that results page on your next reply.

.

I notice your pc has Hitmanpro.   Did that find any malware ? ?

 

Please read all of these lines first so that it is all clear to you about our plan. I need a one time run of MBAR like listed here, please.

Please download Malwarebytes Anti-Rootkit (MBAR) from this link here

and save it to your desktop.

 

Doubleclick on the MBAR file and allow it to run.

•Click OK on the next screen, to allow the package to extract the contents of the file to its own folder named mbar.

•mbar.exe will launch automatically. On some systems, this may take a few extra seconds. Please be patient and wait for the program to open.

•After reading the Introduction, click 'Next' if you agree.

•On the Update Database screen, click on the 'Update' button.

•Once you see 'Success: Database was successfully updated' click on 'Next', then click the Scan button.

With some infections, you may see two messages boxes:

1.'Could not load protection driver'. Click 'OK'.
2.'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.

•If malware is found, press the Cleanup button when the scan completes. .

Please attach the log it produces, you'll find the log in that mbar folder as MBAR-log-<date and time>***.txt . Please attach that to your next reply.
 

 

 

[oweng12345]

This is what Virus Total found https://www.virustotal.com/gui/file/f950d1260f53930c5fade7d774294eff9b225e3d5d21d225766fc117dfffbd3d/detection , i uploaded it as a RAR because i did not want to extract it as it would infect my Computer again, but in the folder there is a file just called "Discord Nitro" and it's just in a FILE format, if you need me to analyse that let me know. Also hitman pro did not find any malware, probably because it was already quarantined on malwarebytes. I ran the anti rootkit scan and it did not find anything.

mbar-log-2019-08-01 (17-33-58).txt

[Maurice Naggar]

Thank you.

Notice that MBAR anti-rootkit reports no rootkit.   No malware.

 

Let’s start by doing a new thorough scan with Malwarebytes for Windows.  Close all browsers & games  ( if any) before pressing scan button.

Start Malwarebytes.

Click Settings. Click Protection tab & scroll down to Scan options.

On the section "Potential Threat Protection"
look down at the one "Potentially Unwanted Programs (PUPs)" look and make sure it is set to
"Always detect PUPS ".

and

look down at the one "Potential Unwanted Modifications (PUM)" look and make sure it is set to
"Always detect PUM ".

and
scroll all the way down to the section Automatic Quarantine
On the line "Automatically quarantine detected malware" be sure it is ON



Then once all set there, click on SCAN button
Then insure Threat scan has a check mark. Then click Start scan.
Review the results list.
Then I would suggest you make sure all lines have a check mark

To that end, if you click the very top left checkbox you can force all detected lines ( if any are detected)  to be selected for removal. Be sure each line is checked.

 

Then you can proceed to click on the blue button Quarantine selected.

In Malwarebytes.
Click the Reports button ( on the left )
Look for the "Scan Report" that has the most recent Date and time.

When located, click the check box for it and click on View Report.
Then click the Export button at the bottom left.
Then select Text File (*.txt)

Put in a name for that file and remember where the file is created.

Then attach that file with your next reply 

 

[oweng12345]

I ran a scan before this one and quarantied the RAR file

scan.txt

[Maurice Naggar]

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 276058
Threats Detected: 0
Threats Quarantined: 0

 

This last scan found no active malware.

.

I would suggest a free scan with the ESET Online Scanner
Go to https://www.eset.com/us/home/online-scanner/

Look on the right side of the page.  Click Scan Now
It will start a download of "esetonlinescanner_enu.exe"
Save the file to your system, such as the Downloads folder, or else to the Desktop.

Go to the saved file, and double click it to get it started.
When presented with the initial ESET options, click on "Computer Scan".

Next, when prompted by Windows, allow it to start by clicking Yes

When prompted for scan type, Click on Full scan
Click on the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.

Have patience.  The entire process may take an hour or more. There is an initial update download.
There is a progress window display.
You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.

When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.

Click The blue “Save scan log” to save the log.

If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at bottom).

Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

[oweng12345]

nothing was removed i think i'm good thanks anyway.

scan 2.txt

[Maurice Naggar]

So, Eset online reports no infection.   That is a very good result.

If you want yet another opinion, you can get one at Microsoft.

You can check this system using another free tool at Microsoft.  For another opinion.

The Microsoft Safety Scanner is a free stand-alone virus scanner that  can be used to scan for & remove malware or potentially unwanted software from a system.

The download links & the how-to-run-the tool are at this link at Microsoft

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

take a minute to locate & then send the log that it made, named msert.log

It should be at C:\Windows\debug\msert.log

 

 

[oweng12345]

Okay i have ran the scan, and it appears that nothing is infected anyway thanks for all the help and here is the log file.

msert.log

[Maurice Naggar]

The result from the Microsoft Safety scanner is excellent.

Results Summary:
----------------
No infection found.
Microsoft Safety Scanner Finished On Fri Aug 02 01:48:01 2019

 

Here are some suggestions to strenghthen your web browsers.

See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

 

 

 

You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10), or on Opera.

 

Scroll down to the tips section "How do I disable them".

 

[ 2 ]

also, if you use Chrome or Firefox browser, install the Malwarebytes beta browser extension.  There is one for Chrome & another for Firefox.

 

For Chrome:    To get & install the Malwarebytes beta Chrome extension,

 

Open this link in your Chrome browser: https://chrome.google.com/webstore/detail/malwarebytes/ihcjicgdanjaechkgeegckofjjedodee

 

Then proceed with the setup.

.

For FIREFOX:  

get & install the Malwarebytes beta Firefox extension.

Open this link in your Firefox browser: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

Then proceed with the setup.

.

 

For ongoing and long term security.

Each pc user needs to practice daily safe computer and internet use.

 

Safer practices & malware prevention:
Follow best practices when browsing the Internet, especially on opening links coming from untrusted sources.
First rule of internet safety: slow down & think before you "click".
Free games & free programs are like "candy". We do not accept them from "strangers".

Never open attachments that come with unexpected ( out of the blue ) email no matter how enticing.
Never open attachments from the email itself. Do not double click in the email. Always Save first and then scan with antivirus program.

Never click links without first hovering your mouse over the link and seeing if it is going to an odd address ( one that does not fit or is odd looking or has typos).

 

Pay close attention when installing 3rd-party programs. It is important that you pay attention to the license agreements and installation screens when installing anything off of the Internet. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed.
Take great care in every stage of the process and every offer screen, and make sure you know what it is you're agreeing to before you click "Next".

Use a Standard user account rather than an administrator-rights account when "surfing" the web.
See more info on Corrine's SecurityGarden Blog http://securitygarden.blogspot.com/p/blog-page_7.html
Dont remove your current login. Just use the new Standard-user-level one for everyday use while on the internet.


Check in at http://windowsupdate.microsoft.com 
Windows Update and install any Important Updates offered.

Make certain that Automatic Updates is enabled.
https://support.microsoft.com/en-us/help/12373/windows-update-faq

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

For other added tips, read "10 easy ways to prevent malware infection"

.With best wishes to you.

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks