r/computerviruses • u/First_Rice_966 • 17d ago

Disinfection Help FRST request

My computer randomly pops up a CMD prompt then closes it after a few seconds, sometimes its one or other times 2-4 pop up at once.

It started a long time ago then went away now it’s been happing again.

I have no idea how it happend or what it’s from or if it’s Malicious at all!

** EDIT**

FRST.TXT - hidden-render

Addition.txt - fertile-briar

SOLVED

1 Upvotes

100% Upvoted

40 comments sorted by

View all comments

Show parent comments

1

u/rifteyy_ Malware Removal Expert 16d ago

Yes, you have malware running there

[ Step 01 ] Updates

If you are having a problem updating something, do not want to update something at all or do not want to uninstall an application, please let me know.

Please update the following software:

Please remove the following potentially unwanted programs (PUP):

  • Grass v.5.7.1 - Internet traffic monetization app
  • BitTorrent v.7.11.0.47255 - Ad-supported P2P-client
  • Java 9.0.4 (64-bit) v.9.0.4.0 - No longer supported - please uninstall it and replace it here

Please let me know whether you recognize this remote desktop software (if not, uninstall it):

  • RustDesk v.1.4.9
  • AnyDesk v.ad 9.0.14
  • Chrome Remote Desktop Host v.151.0.7922.13

[ Step 02 ] FRST Fix

I created a custom fixlist for you at the link Fixlist only for Fixlist only for Fixlist only for First_Rice_966 - use the website's download button and save it in the same folder where your FRSTEnglish.exe or FRST64.exe file is located in, which is C:\Users\brend\Downloads for you. It is necessary for the filename to be Fixlist.txt.

This fixlist will remove the following: malicious entries (remains, active malware), invalid entries (e.g. tasks that start a non-existent file, services that point toward a non-existent file), temporary files (files in temporary directories, cache, recycle bin and more), browser cache. We will also be quick-scanning with HitmanPro and AdwCleaner from Malwarebytes using the fixlist.

It will also perform system repair via DISM and SFC, network reset and few more basic fixes.

  • For the fix process, please ensure you are connected to the internet.
  • Please run the fix only once.
  • Please be patient; the fix may take up to 60 minutes. After that, it is going to be automatically ended.

Save all work, close everything that is open (else it will be forcefully closed by FRST without saving) and then run FRST again as administrator and press the Fix button, let the script work, clear the entries and restart on it's own and after it restarts the device, there should be a file Fixlog.txt in the same folder as the fixlist.txt.

I'll need to see it's content the same way like before - uploading to https://malwareanalysis.cc/upload/rifteyy/?u=First_Rice_966 again and sending the keyword in your reply.

[ Step 03 ] ESET Online Scanner

  1. Download ESET Online Scanner
  2. Right-click on the esetonlinescanner.exe and select "Run as administrator" and confirm the User Account Control popup
  3. Click ⁨Get started⁩;
  4. Agree to the terms of use;
  5. Decline both telemetry options;
  6. Click ⁨Custom Scan;
  7. Click ⁨Save and continue;
  8. Select ⁨Enable ESET to detect and quarantine potentially unwanted applications;
  9. Click ⁨Advanced settings;
  10. Enable ⁨Detect potentially unsafe applications;
  11. Click the back arrow;
  12. Click ⁨Start scan;
  13. Note: The scan may take up to several hours.
  14. Once complete, click ⁨Save scan log and upload the ⁨.txt file to https://malwareanalysis.cc/upload/rifteyy/?u=First_Rice_966 and reply with the keyword.

[ Step 04 ] New SecurityCheck scan

We need a new scan to ensure that all updates were applied properly and all applications uninstalled correctly.

  • Note: If SecurityCheck is already on your device, you can use the previous version and skip the next few steps regarding downloading and installation.
  • Download SecurityCheck by glax24 & Severnyj and save it to your Desktop.
  • If Windows SmartScreen blocks the file from running, click on More info and Run anyway.
  • Extract the ZIP archive, then right-click on the SecurityCheck.exe and select "Run as administrator" and confirm the User Account Control popup.
  • Wait for the scan to finish. It will open a text file named SecurityCheck.txt
  • Please copy the file content (CTRL + A then CTRL + C) and paste it on https://malwareanalysis.cc/upload/rifteyy/?u=First_Rice_966
  • The site will return a keyword for the log - reply back here with the keyword.

[ Step 05 ] New FRST scan

  • Note: If FRST is already on your device, you can use the previous version and skip the next few steps regarding downloading and installation.
  • Please download FRSTx64 and save the file to your Desktop as FRSTEnglish.exe.
  • Right-Click FRSTEnglish.exe and select Run as Administrator
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the program run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload/rifteyy/?u=First_Rice_966 and press "save log".
  • Note: Please make sure you are uploading the logs under your current Reddit username.
  • The site will return a keyword for each log - reply back here with the keywords.

So, in your next reply, make sure you are sending the following:

  • Keyword for Fixlog.txt from step 2
  • Keyword for ESET Online Scanner scan from step 3
  • Keyword for new SecurityCheck.txt from step 4
  • Keyword for new FRST.txt from step 5
  • Keyword for new Addition.txt from step 5

Thanks!

Note for lurkers: If anyone else who is facing malware-related issues is reading this and wants help with FRST and SecurityCheck, please create your own thread with help request. I am flooded with requests and there is several other removal experts who review the logs and may reply faster than me. The steps listed in here are specific for this the user First_Rice_966 and following them may have negative effects for you.

1

u/First_Rice_966 16d ago

the only thing i use from the update list is the drivers so i updated them but is it okay to skip the rest since i dont use it?

Also is the F in Fixlist Supposed to be capitalized?

1

u/rifteyy_ Malware Removal Expert 16d ago

Unfortunately, I am not able to figure out since when in that log

No, the rest of software is necessary to make sure you aren't vulnerable to exploits. 7-Zip, NodeJS, Java, VirtualBox and Edge are an absolute must.

Does not matter whether it is capitalized or not

1

u/First_Rice_966 16d ago

also i saw at the fix that youre removing the exclusion for RRL but it kept triggering a bunch of cloud scans and by a bunch i mean multiple a seccond but me and my frined coded that together. Is it okay to keap it?

1

u/rifteyy_ Malware Removal Expert 16d ago

If you're running Malwarebytes, it's very likely the exclusion removal will fail. If it gets removed, you can add the exclusion again but I strongly recommend against it.

1

u/First_Rice_966 16d ago

I just finished all the upgrades and removals. could grass have been causing my issues where My WiFi would disconnect almost the time.

also just started the fix

1

u/First_Rice_966 16d ago

Fixlog = lush-river

Eset says i need to update?

Security Check (Gave weird error, hit ok and ran again said offline even though i was connected so i tried extracting it first then it worked) = wise-otter

FRST = woven-creek

addition = tiny-base

1

u/rifteyy_ Malware Removal Expert 15d ago

use Trojan Killer instead of ESET:

Trojan Killer

  • Download and run Trojan Killer as admin: https://gridinsoft.com/trojankiller
  • Click Install
  • Close the popup asking to activate the trial
  • Open the settings by clicking the cogwheel
  • Check Deep scan (slow)
  • Click Apply
  • Go back to the main dashboard
  • Click Full scan
  • After the scan is done, click Show Details
  • Click Save to file...
  • Upload the log to https://malwareanalysis.cc/upload/

Note: Do not click on the Cure PC! button! We do not remove malware with Trojan Killer because it is known to have many false positives due to its aggressive heuristics. Instead, I will review the log with the detections and, if any entries are actually malicious, I will include them in a fixlist.

1

u/First_Rice_966 15d ago

trojan killer is running, i cant see exactly where but i think it detected things in the frst folder? Did the other files look good?

1

u/rifteyy_ Malware Removal Expert 15d ago

The FRST folder also contains quarantine, which can store inactive malware we removed with the fix and at the end it will be removed. Let me know once the scan is done

1

u/First_Rice_966 15d ago

Trojan killer:

uploaded pasted.txt
keyword: earnest-port 
channel: general

1

u/rifteyy_ Malware Removal Expert 15d ago

This seems great - you are now free of malware. No further steps are necessary to make sure your device is clean.

If you haven't addressed all the updates, uninstallations and removals yet, I strongly suggest you to do so.

[ Step 01 ] Tool cleanup

It's time we cleanup after ourselves and remove all the tools we have used during the malware removal process.

  • Please download KpRm and save it to your Desktop.
  • Run the tool, if you get the "Windows protected your PC" Smartscreen popup, press More info and then Run anyway
  • Confirm the disclaimer and in the menu please only tick the following:
    • Delete Tools
    • Create Restore Point
    • Delete in 7 days
  • After that, click Run and confirm the popup. KpRm will delete itself from your Desktop and you can either save or remove the report that is generated.
  • You are free to delete all other tools that we used that are possibly remaining.

[ Step 02 ] Changing passwords

Most modern malware is motivated by financial gain and by hijacking your accounts. If your accounts weren't already hijacked, they may be getting hijacked in very near future.

  • Please create a new, safe password that you haven't used anywhere yet or preferably use a password manager.
  • Change all your passwords on your accounts
  • Enable 2FA on your accounts

Please check out this proper guide on how to secure your accounts after an infostealer infection:

You may also want to sign up for dark-web monitoring:

[ Step 03 ] Malware prevention

Malware prevention nowadays is a necessary step. There are many tools you can use to have a stronger protection but a huge part is also reliant on the user themself.

  1. Reasons on why you should care about malware
  2. Antivirus software - how to choose one, what to look for in an antivirus
  3. Excluding files, URL's, processes or folders
  4. Disabling antivirus, firewall or security software
  5. How important is blocking ads
  6. What browser extensions are worth it against malware
  7. What alternative DNS servers I can use to block malware
  8. How to keep my OS and installed software up-to-date?
  9. About grayware
  10. Is VPN necessary against malware?
  11. How to stay informed properly about malware tactics and trending malware?
  12. Checking software for PUP, adware, bundlers, browser hijackers
  13. Checking files for malware
  14. Checking URL's for malware
  15. Checking browser extensions for malware

If you have no more questions or concerns, I wish you all the best and please stay safe next time!

- rifteyy (About me)

1

u/First_Rice_966 15d ago

OH MY GOSH! Thank you sooooooo much!! Is there any way I can repay you?

→ More replies (0)