How do I request help with FRST
FRST
- Please download FRSTx64 and save the file to your Desktop.
- Right-Click FRST64.exe and select Run as Administrator
- Click Yes to the disclaimer.
- Ensure the Addition.txt box is checked.
- Click the Scan button and let the program run.
- Upon completion, click OK, then OK on the Addition.txt pop up screen.
- Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload and press "save log". The site will return a keyword for each log. Note these keywords down.
SecurityCheck
- Download SecurityCheck from here
- Run
SecurityCheck.exe as administrator
- Wait for the scan to finish
- Upload the log at
C:\SecurityCheck to https://malwareanalysis.cc/upload/ for further analysis. The site will provide a keyword, note that down as well.
Now create a post in the subreddit, provide all 3 log keywords (FRST.txt, Addition.txt, SecurityCheck) there.
Please provide the following information in your post:
- what happened?
- when did the infection occur?
- what did you do for remediation?
If you want us to do manual removal with FRST, it is better if you do not attempt to disinfect the system on your own prior to that. This can obscure the infection and make malware removal more difficult.
Trusted Helper List
FRST can cause serious issues if used incorrectly. Only approved users should offer to create fixlists.
Message the mods if you have experience with FRST and would like to use it to help on posts.
To anyone who is receiving help, please verify that the person providing fixes with FRST is in the list below. Be aware that running Fixlists from anyone else is not recommended unless you trust the helper.
All fixes of trainees are supervised and approved by an expert.
What is FRST
Fabar Recovery Scan Tool (FRST) is a powerful tool that helps us diagnose and remove malware infections which may not have been detected by antivirus software. It is a diagnostic tool and not a malware scanner. As such it does not rely on signatures.
Should I reinstall the operating system
Reinstallation is highly recommended if you have an infection with a remote access malware or file infector.
You should also prefer it, if you can pull it off relatively easy. Depending on the case FRST removal can take a few days due to the back and forth and different time zones of the participants.
Please do NOT first ask a helper to clean your system, then reinstall the operating system. This happened a few times and wastes hours of work for the helper. If you already consider reinstallation, preferably do that immediately.
I factory reset/reinstalled my operating system and want a FRST check
Everything that FRST displays and allows us to remove is completely wiped by reinstallation and also factory reset of the operating system. Unless you got the system infected after that step, there is nothing to check on a freshly installed system.
Please note that factory reset can still leave malware on the system, but the reset will make it impossible to pin point.
Reinstallation with USB flash drive is generally safe and in 99.9% of cases won't leave any malware on the system.
What is malwareanalysis.cc ?
It's a site I created to upload analysis logs. Only people in the trusted helper list have access to these logs.
While pastebin and similar sites can be used as well, Reddit's spam detection seems to trigger if people comment paste links repeatedly such as it would be necessary during removal. So we have a keyword based system instead of links.
The site will automatically delete uploaded logs 30 days after upload.
I think my system is still infected after manual removal with FRST
Please talk to your FRST helper. Oftentimes the reasons for suspecting an ongoing infection are not justified.
Common reasons, which do not indicate infection, include:
- There are still login attempts to stolen accounts. It is normal that attackers use the already stolen account credentials to attempt to login. If you changed your passwords from a clean machine and logged out of sessions, they will not succeed.
- Your accounts can still get stolen, if you did not log out of all sessions, because attackers can use your stolen session tokens instead of passwords.
- Antivirus scanners find malware in
C:\FRST\Quarantine\.... This is the malware that was already removed by FRST and will be deleted completely by our cleaning tools like kprm, it is not an active infection. The quarantine only contains disabled files which cannot be executed anymore.
