Infected

Ok guys. Need your advices.
Today I tried logging into my acc and the pass was changed. Quickly recovered it and found that the recoveries were deleted, but noone logged into the char. Only the pass and recs were changed. So I quickly deleted rsbuddy bot and all his files (since I think this could've only had a keylogger or something). Then I ran a quick scan on malwareBytes ( I found somewhere written that it is good at finding keyloggers rats). It found only 2 files, first one was some kind of rogue crap and the other one was PUM.Disabled.SecurityCenter. So as I think it didn't found any keylogger/rat or something liek that.

Im currently Running a full scan on Avira and hoping it will find something. But ~80% scanned and still nothing. So maybe there are some other ways to find out what is happening and find the source of this? :s

 

Do a system restore to the last time you know your computer was protected.

 

Hm. might try. By the way, how to do that and what can be affected by doing this?

 

System restores are often also infected as soon as your PC gets infected, so I wouldn't bother doing that. It's best to boot into safe mode (press f8 repeatedly once you've restarted your pc), select safe mode and run your anti virus and anti malware programs.

(I work in IT so I know what I'm on about.)

 

Allright. I'll do that. By the way, si a quick scan ok or should I run the full system scan?

 

You have a virus. Don't be stupid; run the full scan.

 

ok trying this out. thanks

 

No problem. This usually costs people $40 an hour, so enjoy my generosity.

 

Ok. I scanned my pc in the safe mode, but nothing was found. So I suppose the threat is gone? OR is there something more that can be done to make sure everything is fine now?

 

Download CCleaner, Anti-Malware Bytes & run a scan.

 

No this won't help anything, also if avast and MBAM don't find anything you're most likely safe. Try doing a hitman pro scan aswell it's fairly fast and effective.

 

You could try going on HF and posting a report there.

 

Save As Much valuable info and stuff you need and whack a factory reset =D
I Do it all the time when i think or i know i have a virus
Good for me though i only use it to bot and for facebook so i only need my auth codes and im good to go

 

Allright, trying that.

HF report? What is that?

 

http://sythe.org/showthread.php?t=10232079

And most likely you do have a RAT/Keylogger ect. As I'm 99% sure any half-brained hacker to create malware or some sort of Trojan won't be aiming for runescape accounts. They would aim for credit cards, emails, or just add you to a massive botnet. Unless you entered your information on a fake RS website or something.

 

It says there's no such thread.

Well, I havn't entered my rs info anywhere except the rs. That's for sure. The only thing, Imo, that could've had a rat/logger was rsbuddy bot, since it was the only thing I've downlaoded lately (except a few movies). At the same time I found out my password was changed, I deleted the bot and it's folder. So maybe that might've erased the threat?

 

http://sythe.org/showthread.php?t=1023207

Herp derp, I must have copied the wrong thread.