Solved Backdoor on my pc (Solved)

[Ichigo]

Here's the fixlog but does it mean that I still had the backdoor on my computer or was it for something else?

 

[Ichigo]

Im currently scanning with eset scanner

 

[Malnutrition]

The fix was just me being thorough, there were remnants of the infection ....

But as I suspected, there is a bit of another piece of malware, that has been detected. I had FRST check it at virus total.

VirusTotal

VirusTotal

www.virustotal.com

We will need to remove it with FRST. It is this file, the last thing I suspected from your logs.

c:\users\pcgamer\appdata\roaming\modestmenu\secretscan.exe

Here is your fixlist. Run this when Eset is done, Eset is a bit aggresive, so it may detect minor things, no need to be alarmed if the detection level is high.

 

[Ichigo]

okay

 

[Ichigo]

what are the consequences of this malware?

 

[Malnutrition]

What you already know, they had access to your accounts of social media, possibly your banking information what ever pictures files etc you had on your machine, a fresh format is not going to change that, the malware is gone now. It is up to you to change all your passwords and notify your bank that your computer was infected. From this point on I'd stay away from torrents.

 

[Ichigo]

I meant what are the consequences of this one
c:\users\pcgamer\appdata\roaming\modestmenu\secretscan.exe

 

[Malnutrition]

If you are asking about the latest detection from VirusTotal. I am not sure it is the last file I thought might be a problem, there is not much information about it. It may well be safe, but if two or more engines detect something, then I remove it. Unless it is known to be safe to the user.

 

[Malnutrition]

These scanners do get things wrong sometimes. I just play things on the safe side.

 

[Malnutrition]

@Ichigo Do you have questions about anything else, or do you consider the issue resolved?

 

[Ichigo]

Here is the eset log (this was before the FRST fix)

 

[Ichigo]

@Ichigo Do you have questions about anything else, or do you consider the issue resolved?

I don't have any question if you are 100% sure the backdoor isnt on my computer anymore, thank you so much for the help! Have a good day.

 

[Ichigo]

Actually I got a question

 

[Ichigo]

I used to use the clipboard, but now I can't activate it

 

[Ichigo]

it says in yellow that some of these settings are hidden or managed by my organization

 

[Malnutrition]

Post the latest fixlog from FRST as well.

Open elevated command prompt and copy and paste each command below, hitting enter after each.

RD /S /Q "%WinDir%\System32\GroupPolicyUsers" && RD /S /Q "%WinDir%\System32\GroupPolicy"

gpupdate /force

Download KPRM then save to desktop.
Right click run as admin.
Check mark, restore system settings.
Click the run button.


Then reboot your computer. Check that the issue is gone with the clipboard.

 

[Malnutrition]

May need to use these commands and do them one at a time hitting enter after each. Then reboot the computer after.

RMDIR /S /Q "%WinDir%\System32\GroupPolicyUsers"

RMDIR /S /Q "%WinDir%\System32\GroupPolicy"

gpupdate /force

---

---

---

RD /S /Q "%WinDir%\System32\GroupPolicy"

RD /S /Q "%WinDir%\System32\GroupPolicyUsers"

gpuрdаte /force

 

[Malnutrition]

If the above does not help, then create and run a batch file.

Open a notepad and copy the content of the code box below, paste into open notepad and save it to your desktop as clean.bat then right click on clean.bat and run as admin. It is very important to run the batch file as admin!!

Note: You should allow the n batch file to complete, Once it reboots your machine that is when it is done.


Do not copy the word Code:

wmic /Namespace:\\root\default Path SystemRestore Call Enable "%SystemDrive%"
WMIC /Namespace:\\root\default Path SystemRestore Call CreateRestorePoint "BatchRestorePoint", 100, 10
SC config trustedinstaller start=auto
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies" /f
reg delete "HKCU\Software\Microsoft\WindowsSelfHost" /f
reg delete "HKCU\Software\Policies" /f
reg delete "HKLM\Software\Microsoft\Policies" /f
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies" /f
reg delete "HKLM\Software\Microsoft\WindowsSelfHost" /f
reg delete "HKLM\Software\Policies" /f
reg delete "HKLM\Software\WOW6432Node\Microsoft\Policies" /f
reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies" /f
gpuрdаte /force      
shutdown -r
Exit /B

If you are unable to copy and paste, I have uploaded the batch file for you. Unzip it to your desktop, right click run as admin. Must be ran from the desktop

 

[Ichigo]

Here's the latest fix log

 

[Ichigo]

It has been 10 minutes that it is updating