Jump to content

Hacked Instagram and Email (Laptop)

haydn

By haydn,
in Help, my PC is infected!

 Share

Recommended Posts

ShadowPuterDude

ShadowPuterDude

Posted
Posted

Do the following:

Download AdwCleaner and save it on your desktop.

  1. Close all open programs and Internet browsers (you may want to print our or write down these instructions first).
  2. Double click on adwcleaner.exe to run the tool.
  3. Click on the Scan button.
  4. After the scan has finished, click on the Clean button.
  5. Confirm each time with OK.
  6. You will be prompted to restart your computer. A text file will open in Notepad after the restart (this is the log of what was removed), which you can save on your desktop.
  7. Attach that log file to your reply by clicking the More Reply Options button to the lower-right of where you type in your reply.
    NOTE: If you lose that log file for any reason, you can find it at C:\AdwCleaner on your computer.


Download Junkware Removal Tool and save it on your desktop.

  1. Run the tool by double-clicking it.
  2. The tool will open and start scanning your system.
  3. Please be patient as this can take a while to complete depending on your system's specifications.
  4. On completion, a log is saved to your desktop and will automatically open.
  5. Attach the JRT log file to a reply by clicking the More Reply Options button to the lower-right of where you type in your reply.

Copy the below code to Notepad; Save As fixlist.txt to your Desktop.

HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [  OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [  OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [  OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [  OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [  OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [  OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [  OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [  OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [  OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [  OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-1044555289-3825450328-3019752678-1001 -> DefaultScope {2DBDFCD3-71A7-4C23-A4B7-3645537AE564} URL = 
SearchScopes: HKU\S-1-5-21-1044555289-3825450328-3019752678-1001 -> {2DBDFCD3-71A7-4C23-A4B7-3645537AE564} URL = 
2017-03-16 07:36 - 2016-09-24 10:33 - 00003434 _____ C:\WINDOWS\System32\Tasks\{995C167A-3E0F-4C93-9F4E-25AFC941B578}
CustomCLSID: HKU\S-1-5-21-1044555289-3825450328-3019752678-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Bob\AppData\Local\Microsoft\OneDrive\17.3.6798.0207\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-1044555289-3825450328-3019752678-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Bob\AppData\Local\Microsoft\OneDrive\17.3.6798.0207\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-1044555289-3825450328-3019752678-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Bob\AppData\Local\Microsoft\OneDrive\17.3.6798.0207\amd64\FileSyncShell64.dll => No File
Task: {22F22776-6765-48B1-9584-8CCE18CE75CE} - System32\Tasks\{0B790847-0E7A-050D-7811-787D0E091109} => powershell.exe -nologo -executionpolicy bypass -noninteractive -windowstyle hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAcwB0AG8AcAAiADsAJABzAGMAPQAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAVwBhAHIAbgBpAG4AZwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJABzAGMAOwAkAFAAcgBvAGcA (the data entry has 9432 more characters). <==== ATTENTION
Task: {6CC6581E-323A-48EE-BB1B-A46E9FF5EC2E} - System32\Tasks\IHSelfDeleteTASK => CMD /C DEL C:\Users\Bob\AppData\Local\Temp\IHU5700.tmp.exe <==== ATTENTION
Task: {93C5BAE3-213F-4587-9012-F9EC2CF69E5C} - System32\Tasks\IHUninstallTrackingTASK => CMD /C DEL C:\Users\Bob\AppData\Local\Temp\IHU56B1.tmp.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:AC64BB05 [174]
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\11598763487076930564
C:\Users\Bob\Downloads\winzip20.exe
C:\WINDOWS\system32\Tasks\{0B790847-0E7A-050D-7811-787D0E091109}

Close Notepad.

NOTE: It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 and press the Fix button just once and wait.

If the tool needed a restart please make sure you let the system restart normally and let the tool complete its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Attach it to your reply.

Note: If the tool warns you about an outdated version please download and run the updated version.

Link to comment
Share on other sites
haydn

haydn

Posted
  • Author
Posted

I did Kevin but since I got my laptop working it started running really slow considering it should be faster than a mac book pro I was up until 2am as I needed to process images for clients and found my c:\windows temp file had been made read only once I made it read write I was able to clean 2.8 gigs worth of data and the laptop is running ok 

Link to comment
Share on other sites
ShadowPuterDude

ShadowPuterDude

Posted
Posted

Good to hear the Laptop is working better.  The FRST logs you posted in your las reply show the same issues.

Copy the below code to Notepad; Save As fixlist.txt to your Desktop.

HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [  OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [  OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [  OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [  OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [  OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [  OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [  OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [  OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [  OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [  OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-1044555289-3825450328-3019752678-1001 -> DefaultScope {2DBDFCD3-71A7-4C23-A4B7-3645537AE564} URL = 
SearchScopes: HKU\S-1-5-21-1044555289-3825450328-3019752678-1001 -> {2DBDFCD3-71A7-4C23-A4B7-3645537AE564} URL = 
2017-03-16 07:36 - 2016-09-24 10:33 - 00003434 _____ C:\WINDOWS\System32\Tasks\{995C167A-3E0F-4C93-9F4E-25AFC941B578}
CustomCLSID: HKU\S-1-5-21-1044555289-3825450328-3019752678-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Bob\AppData\Local\Microsoft\OneDrive\17.3.6798.0207\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-1044555289-3825450328-3019752678-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Bob\AppData\Local\Microsoft\OneDrive\17.3.6798.0207\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-1044555289-3825450328-3019752678-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Bob\AppData\Local\Microsoft\OneDrive\17.3.6798.0207\amd64\FileSyncShell64.dll => No File
Task: {22F22776-6765-48B1-9584-8CCE18CE75CE} - System32\Tasks\{0B790847-0E7A-050D-7811-787D0E091109} => powershell.exe -nologo -executionpolicy bypass -noninteractive -windowstyle hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAcwB0AG8AcAAiADsAJABzAGMAPQAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAVwBhAHIAbgBpAG4AZwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJABzAGMAOwAkAFAAcgBvAGcA (the data entry has 9432 more characters). <==== ATTENTION
Task: {6CC6581E-323A-48EE-BB1B-A46E9FF5EC2E} - System32\Tasks\IHSelfDeleteTASK => CMD /C DEL C:\Users\Bob\AppData\Local\Temp\IHU5700.tmp.exe <==== ATTENTION
Task: {93C5BAE3-213F-4587-9012-F9EC2CF69E5C} - System32\Tasks\IHUninstallTrackingTASK => CMD /C DEL C:\Users\Bob\AppData\Local\Temp\IHU56B1.tmp.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:AC64BB05 [174]
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\11598763487076930564
C:\Users\Bob\Downloads\winzip20.exe
C:\WINDOWS\system32\Tasks\{0B790847-0E7A-050D-7811-787D0E091109}

Close Notepad.

NOTE: It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 and press the Fix button just once and wait.

If the tool needed a restart please make sure you let the system restart normally and let the tool complete its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Attach it to your reply.

Note: If the tool warns you about an outdated version please download and run the updated version.

Link to comment
Share on other sites
haydn

haydn

Posted
  • Author
Posted

Hi the emsisoft security kept quarantining your fixlist so i had to restore it, i noticed some files i create become read only and it is difficult to make them read write i guess this prevents anti malware programs removing newly installed programs and scipts ?

Fixlog.txt

Link to comment
Share on other sites
ShadowPuterDude

ShadowPuterDude

Posted
Posted

A couple of items that still need to be addressed.

Copy the below code to Notepad; Save As fixlist.txt to your Desktop.

Task: {7712A308-C021-4A7E-957F-53D32958751A} - \{995C167A-3E0F-4C93-9F4E-25AFC941B578} -> No File <==== ATTENTION
C:\$Recycle.Bin\S-1-5-21-1044555289-3825450328-3019752678-1001\$R6N9LR6.txt

Close Notepad.

NOTE: It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 and press the Fix button just once and wait.

If the tool needed a restart please make sure you let the system restart normally and let the tool complete its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Attach it to your reply.

Note: If the tool warns you about an outdated version please download and run the updated version.
 

Link to comment
Share on other sites
haydn

haydn

Posted
  • Author
Posted

Hi Kevin seems to be running much better thank you for all your help, Kevin (The Mal Miester) Zoll :) I still haven't got my Instagram back I'm guessing that's lost forever as they don't have phone support and the hack reports ive raised with Instagram have returned no results

Ive closed the old email account that was used in multiple applications and log ins, as it appears this was the basis of the hacking once the hacker / bot had this it was using it predominantly to track trace my accounts in multiple applications, took pretty much a week to change everything over to new accounts and try and get a defence to the attacks that seemed to be predominantly on my bank and financial accounts, luckily my banking orgs have a three part access process that is very hard to crack, I'm a little worried about trying to get my Instagram back as this may make me a target again so may be worth just opening a new account

Emsisoft made the whole process easier to deal with I thought I was going to have to do a full windows reinstall to clear all the bugs but thanks to you guys ive saved a lot of data that would normally have been lost it seems once I downloaded this rouge malware they closed down my virus protection including Malwarebytes that appears useless against this form of malware

Thanks Again to the whole Emsisoft team regards Paul Davies SE UK  

Link to comment
Share on other sites
ShadowPuterDude

ShadowPuterDude

Posted
Posted

Hi Paul,

If your contact info for Instagram is outdated, you most likely have lost that account.

Glad we were able to help you.

Unless you are having problems, it is time to do the final steps.

Now to remove most of the tools that we have used in fixing your machine:

Download Delfix from here and save it to your desktop.

  • Ensure Remove disinfection tools is checked.
  • Also place a checkmark next to:
    • Create registry backup
    • Purge system restore

  • Click the Run button.


When the tool is finished, a log will open in notepad. I do not need the log.  You can close Notepad.

Empty the Recycle Bin

Download to your Desktop:
- CCleaner Portable

  • UnZip CCleaner Portable to a folder on your Desktop named CCleaner


Run CCleaner

  • Open the CCleaner Folder on your Desktop and double-click CCleaner.exe (32-bit) or CCleaner64.exe (64-bit)
  • Click "Options" and choose "Advanced"
  • Uncheck "Only delete files in Windows Temp folders older than 24 hours"
  • Then go back to "Cleaner" and click the "RunCleaner" button.
  • Exit CCleaner.


You can delete and uninstall any programs I had you download, that you do not wish to keep on the system.

To Remove EEK simple delete the EEK for in the of your System Drive, normally C:\EEK

Run Windows Update and update your Windows Operating System.

Articles to Read:
How to Protect Your Computer From Malware
How to keep you and your Windows PC happy
Web, email, chat, password and kids safety
10 Sources of Malware Infections

That should take care of everything.

Safe Surfing!

Link to comment
Share on other sites
ShadowPuterDude

ShadowPuterDude

Posted
Posted

Thread Closed

Reason: Resolved

The procedures contained in this thread are for this user and this user only.  Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair.  Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist.

All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE if you don't we are just going to send you back to this thread.

Link to comment
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

Products & Services

Ransomware/Malware Removal

Partners

Resources

Company

© 2003-2022 Emsisoft - 06/27/2022 - Legal Notice - Terms - Bug Bounty - System Status - Privacy Policy

×
×
  • Create New...