Jump to content

Pretty certain i've picked up a RAT, follows me even after clean installs

YoitsArk
 Share

Recommended Posts

YoitsArk

YoitsArk

Posted
Posted

Hey guys so i started noticing a few months ago my Windows Defender making changes and turning itself off, followed by a significant drop in my gaming performance and the problems kept on coming. I checked Task manager and noticed tonnes of SVCHost.exe's like a lot more then usual with names like:

svchost.exe Service Host: UdkUserSvc_4fce8

svchost.exe Service Host: DCOM Server Process Launcher

svchost.exe Service Host: NPSMSvc_4fce8

I've had my user account locked into workgroup, I can no longer update my pc, windows defender keeps being turned off. I'm almost certain someone has gained remote access and is using my computer to run a bunch of VMs as I've seen multiple instances of Hyper-V doing things when i disabled all services and it in MSCONFIG.

Often my mouse moves on its own, my browser logs me out of google everytime i log in, my mouse pointer keeps reverting back to the default after i change it, etc.
I performed a PStools logonsessions check via commandline and found 13 difference logon sessions running multiple apps, it has something to do with windows NT/NT authority, please help.

mb.txt Addition.txt FRST.txt

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Hello :welcome: @YoitsArk

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

  • Removing malware can be unpredictable
  • Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Only run the tools I guide you to.
  • Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
  • The removal of malware isn't instantaneous, please be patient.
  • Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
  • Please stick with me until I give you the "all clear".
  • If your system is running Discord, please be sure to Exit out of it while this case is on-going.

I would like a report set for review. This is a report only.

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then Gather Logs

Have patience till the run has finished.
Attach the mbst-grab-results.zip from the Desktop to your reply..

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Next actions. Please do not try to rely or try to use Task Manager to self-diagnose. Rather than that, rely on this malware-removal expert to guide you. We are going to be running several tools to check this Windows machine. Here is the next thing I would like you to do.

I'd like for you to take one-time actions to power off your PC and any powered printers ( or copiers)  attached & then power off your hardware router.
Start by Shutting down Windows, and powering off your PC.  Then power Off the hardware router. Also, turn off the Hub or Switch for your 'network' ( if any).
Then wait for one minute.
Then power up in reverse order.  First get the router powered up.  Then your Hub or switch for the Network. Wait for a minute.
Then power up PC  and then get Windows started.
>

Link to post
Share on other sites
YoitsArk

YoitsArk

Posted
  • Author
Posted

done, I should also inform you i did a pipelist before seeing your reply and this was the results. 

PipeList v1.02 - Lists open named pipes
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

Pipe Name                                    Instances       Max Instances
---------                                    ---------       -------------
InitShutdown                                      3               -1
lsass                                             4               -1
ntsvcs                                            3               -1
Winsock2\CatalogChangeListener-408-0              1                1
Winsock2\CatalogChangeListener-548-0              1                1
epmapper                                          3               -1
Winsock2\CatalogChangeListener-3fc-0              1                1
LSM_API_service                                   3               -1
Winsock2\CatalogChangeListener-580-0              1                1
atsvc                                             3               -1
Winsock2\CatalogChangeListener-6c0-0              1                1
eventlog                                          3               -1
Winsock2\CatalogChangeListener-884-0              1                1
wkssvc                                            4               -1
trkwks                                            3               -1
MBLG                                              1                1
srvsvc                                            4               -1
Winsock2\CatalogChangeListener-34c-0              1                1
PIPE_EVENTROOT\CIMV2SCM EVENT PROVIDER            1               -1
{A9ADEA7C-F0FD-4354-BC93-C9E182164623}            1               -1
MsFteWds                                          3               -1
NvWksServiceDdisplayPipe                          1               -1
NvMessageBusBroadcastNVIDIA.Display.Driver          5               -1
17b119d2fc7b37340aa674c57194e883bfcf9e50          8               -1
crashpad_5800_BZSTFBDISYHATCWO                    2                2
LOCAL\mojo.5800.1512.15533798188806463403          1                1
LOCAL\mojo.5800.1512.18062353902478168257          1                1
LOCAL\mojo.5800.8700.12713363125670292936          1                1
LOCAL\mojo.5800.8700.13788173608553986348          1                1
LOCAL\mojo.5800.1512.5682672944663693132          1                1
LOCAL\mojo.5800.8700.8355202217000153345          1                1
LOCAL\mojo.external_task_manager_5800             1               -1
LOCAL\mojo.5800.1512.6634161665099555229          1                1
LOCAL\mojo.5800.8700.6778783208462627817          1                1
LOCAL\mojo.5800.1512.12694816806389734428          1                1
LOCAL\mojo.5800.8700.15224819012753118915          1                1
LOCAL\mojo.5800.8700.9648012199582442906          1                1
LOCAL\mojo.5800.8700.14056786088532001559          1                1
LOCAL\mojo.5800.8700.3350791237146284188          1                1
LOCAL\mojo.5800.1512.4260684961382526505          1                1
LOCAL\mojo.5800.8700.2811526581658411706          1                1
LOCAL\mojo.5800.8700.2052445580744665927          1                1
{96F27291-6E73-4A7C-A4A7-80F6CA622001}            1               -1
LOCAL\mojo.5800.8700.6679138328841791624          1                1
LOCAL\mojo.5800.8700.656254823300673089           1                1
LOCAL\mojo.5800.1512.4118717503898476462          1                1
LOCAL\mojo.5800.8700.557279452126140888           1                1
LOCAL\mojo.5800.8700.4356656609414963032          1                1
LOCAL\mojo.5800.8700.8386899891776662274          1                1
LOCAL\mojo.5800.8700.5010319405485920256          1                1
LOCAL\mojo.5800.1512.3381734681618589679          1                1
LOCAL\mojo.5800.8700.2771285827635420095          1                1
LOCAL\mojo.5800.8700.7668786907962379100          1                1
LOCAL\mojo.5800.8700.2656267881091767230          1                1
LOCAL\mojo.5800.8700.5389163951582568012          1                1
LOCAL\mojo.5800.1512.12568377743695502467          1                1
LOCAL\mojo.5800.8700.11168959221081882208          1                1
LOCAL\mojo.5800.8700.9421245264199692094          1                1
LOCAL\mojo.5800.1512.15217346295576180724          1                1
LOCAL\mojo.5800.8700.8384805778884682698          1                1
LOCAL\mojo.5800.8700.13292867092856392753          1                1
LOCAL\mojo.5800.8700.6730750223249027751          1                1
LOCAL\mojo.5800.1512.11665567124597731649          1                1
LOCAL\mojo.5800.8700.9635552821163157061          1                1
LOCAL\mojo.5800.8700.7942616962686313204          1                1

 

mbst-grab-results.zip

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted (edited)

Let us please keep focus on the following. This next job will end all open applications and then do its work. Please read all of this. and remember, there is much more to do even after this here.

The tool FRSTENGLISH.exe tool  is already on this machine

Please download the attached fixlist.txt file and save it to Downloads folder

Fixlist.txt<-- - - - -

 

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Use File Explorer to go to the Downloads folder

RIGHT-Click on   FRSTENGLISH and select 

RUN as Administrator

and reply YES to allow it to go forward to start.

That is important so that this run has Elevated Administrator rights !!

NEXT press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will reset the Winsock file. It will also attempt to  run scans with MS Defender antivirus. It also tries to put back 2 missing Windows services. Depending on the speed of your computer this fix may take 50-55 minutes or more.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply. We will do more, later. We will be running at least 3-4 trusted scanners later on. Stick with me. Keep much patience. Keep current with this case here. Have faith in this helper. As far as I am concerned, one should put aside the "pipelist" tool.

Edited by Maurice Naggar
Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted (edited)

NOTE: You mentioned this at the top 

Quote

 i disabled all services and it in MSCONFIG.

I did see a large list of items that appear to have been change in MSCONFIG.  Noticed that in the Farbar report. My suspicion is that you shot yourself by doing those actions. 

Edited by Maurice Naggar
Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted (edited)

Please have added patience. We will need more rounds to get things squared properly.  This next job will end all open applications and then do its work. Please read all of this. and remember, there is much more to do even after this here.

The tool FRSTENGLISH.exe tool  is already on this machine

Please download the attached fixlist.txt file and save it to Downloads folder

Fixlist.txt<-- - - - -

 

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Use File Explorer to go to the Downloads folder

RIGHT-Click on   FRSTENGLISH and select 

RUN as Administrator

and reply YES to allow it to go forward to start.

That is important so that this run has Elevated Administrator rights !!

NEXT press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply. We will do more, later.

NEXT

I also would appreciate this report:

Download   Farbar's Service Scanner utility

and Save to your Desktop.

Right-Click on fss.exe and select Run As Administrator.

Answer Yes to ok when prompted.

If your firewall then puts out a prompt, again, allow it to run.

Once FSS is on-screen, be sure the following items are check-marked: 

  • Internet Services
Windows Firewall
System Restore
Security Center/Action Center
Windows Update
Windows Defender
Other services

  

Click on "Scan".

It will create a log (FSS.txt) in the same directory the tool is run.   Please attach that file.  

Edited by Maurice Naggar
Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

One other additional request, in addition to those above.

A request please 

I would like to get a copy of what we placed in Quarantine, from the runs I had you do. Please. 

  • Using Windows File Explorer, Navigate to C:\FRST folder on your system. Expand the folder so you see all contents.
  • Right click on Quarantine > Send to > Compressed (zipped) folder
  • Upload the archive in your next reply
  • If archive is too big you can upload here > https://wetransfer.com/

Also, Let me know how the situation is at this point as to any new "block" notices, or some other active security issue.
Also, please do one new Scan with Malwarebytes.

Thank you!

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

If you desire, I can give you the steps to do a actual good clean fresh install of Windows. Let me know if that is what you decide.

The Fix-run I had you run accomplished its purpose, which was to restore 1 Windows service. As to the FSS report that is encouraging. I would like to continue to get other detail. This run will be super quick & it does NOT involve a reboot.

The tool FRSTENGLISH.exe tool  is already on this machine

Please download the attached fixlist.txt file and save it to Downloads folder

Fixlist.txt<-- - - - -

 

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Use File Explorer to go to the Downloads folder

RIGHT-Click on   FRSTENGLISH and select 

RUN as Administrator

and reply YES to allow it to go forward to start.

That is important so that this run has Elevated Administrator rights !!

NEXT press the Fix button just once and wait.

Attach FIXLOG.txt with next reply. We will do more, later.

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

I suggest some renewed patience. And to do a new set of scans. First this one here.

Do a new scan with Malwarebytes for Windows.

Do a Check for Update using the Malwarebytes Settings >> General tab.

See this Support Guide https://support.malwarebytes.com/hc/en-us/articles/360042187934-Check-for-updates-in-Malwarebytes-for-Windows

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions.

Let me know how that goes.    Next, the Malwarebytes sca

Next, click the small x on the Settings line to go to the main Malwarebytes Window.   Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

MB4_scan_tick_ALL.jpg.d5c4071c62ed66534301fbb217b93bc0.jpg

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

MB4_scan_all_Quarantine2.jpg.6c45445994d4125c0b617ac7c5551e03.jpg

 


Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Be very aware, messages like 

Quote

 "some settings are managed by your organization" like remote desktop etc.

we have seen many times and those are just some sorts of glitches or dings. Can be cured if you just stick with me / with us. That message does NOT mean in any way that there is some sort of external boogeyman controller.

Further, you can turn Off Remote Desktop option. That is a feature that is not needed for most home users.

you ought to turn off the Remote Desktop setting

See   https://www.tenforums.com/tutorials/92433-enable-disable-remote-desktop-connections-windows-10-pc.html

 

 

Link to post
Share on other sites
YoitsArk

YoitsArk

Posted
  • Author
Posted
1 minute ago, Maurice Naggar said:

Be very aware, messages like 

we have seen many times and those are just some sorts of glitches or dings. Can be cured if you just stick with me / with us. That message does NOT mean in any way that there is some sort of external boogeyman controller.

Further, you can turn Off Remote Desktop option. That is a feature that is not needed for most home users.

you ought to turn off the Remote Desktop setting

See   https://www.tenforums.com/tutorials/92433-enable-disable-remote-desktop-connections-windows-10-pc.html

 

 

I have it turned off, I know there is a remote boogeyman because they've removed windows defender and have complete control over my pc when they want.

Screenshot 2023-06-19 154144.png

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.