« previous next »
Pages: [1]   Go Down

Author Topic: Dinoraptzor Malware  (Read 1612 times)

0 Members and 1 Guest are viewing this topic.

Offline lazeho

  • Newbie
  • *
  • Posts: 1
Dinoraptzor Malware
« on: January 19, 2020, 11:21:08 AM »
Hello guys at least 5 month i have the problem that sometimes windows/ virus put the cmd.exe into starup and run mit these exe and command which open the dinoraptzor website.
I used hijacked before to find the registry input, and i removed it from the tasks but sometimes when i use my pc it pop up for less then one second the cmd konsole and if i look up the cmd exe is again in startup.
Know i hope FRST tool and you guys can help me to remove this malware permanent.
I ve put these FRST Scan files in the attachments.
Logged

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Dinoraptzor Malware
« Reply #1 on: January 20, 2020, 03:37:56 AM »
Hello Lazeho,

Sorry that no one got around to you earlier. I have asked Sass Drake to drop by and assist you. You'll likely hear from him tomorrow.

I do have to ask though, why do you have a Java Decompiler and a port scanner installed on your system?

2017-08-16 19:48 - 2018-07-10 15:42 - 000001379 _____ () C:\Users\lazeh\AppData\Roaming\jd-gui.cfg
2017-12-26 02:25 - 2017-12-26 02:25 - 000000000 _____ () C:\Users\lazeh\AppData\Local\zenmap.exe.log

Zenmap is the GUI version of the infamous nmap application, and jd-gui is used for decompling Java applications. To be clear, both applications are legitimate (they can be found in a KALI install, or easily downloaded)

I would not recommend using applications like: MegaPack Cracking Tools.exe if you're looking to get into cracking/hacking. HackTheBox is a good utility to learn (and has free options). I might recommend KALI Linux if you're into it. It's built to break into systems. Full range of port scanners, proxy applications, CMB tools, LDAP, AD, etc
Logged
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33900
  • malware fighter
Re: Dinoraptzor Malware
« Reply #2 on: January 20, 2020, 06:05:16 AM »
Hi Michael (allan1998),

Hacking using Kali linux can also be a legit exercise, when the person is training to be or is a trained security pen-tester/researcher. In that case one should always have full written permission from those you perform pentests for.

So does not have to mean necessarily he is in black or grey hat hacking,
could as well be a white hat or pentester for that matter.

polonus (volunteer 3rd party cold recon website security analyst and website error-hunter)

P.S. Mine was a general comment on the legit use of KALI. Go a-cracking with KALI is a big no-no, I will add that.
Same as using XSSight for automated XSS Scanning and to combine it with a payload.injector of sorts.
That is similar abuse. Remember that this is the official avast av forums, not hacker's sub-divison info-ground. :D

Damian
« Last Edit: January 20, 2020, 10:13:41 PM by polonus »
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 820
Re: Dinoraptzor Malware
« Reply #3 on: January 20, 2020, 06:59:26 PM »
  • Open Notepad (click Start button -> type notepad.exe -> press Enter)
  • Copy text from code block below and paste it into Notepad
Code: [Select]
HKU\S-1-5-21-247619900-3785855006-1016407150-1001\...\Run: [19Cent] => cmd.exe /c start www.dinoraptzor.org
GroupPolicy: Beschränkung ? <==== ACHTUNG
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Beschränkung <==== ACHTUNG
  • Go to File -> Save As
  • Make sure that  UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on Desktop
  • Open again FRST and click on button Fix
  • Wait until FRST finishes
  • fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.
Logged
Pages: [1]   Go Up
« previous next »