View original (French)

Llhvy.exe

Solved
CinquiemeSoleil Posted messages 2 Status Member -  
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   -
Hello,

I have the program Llhvy.exe that has infected my computer and I can't get rid of it, I would be grateful if you could help me.

Attached are the links for the three frst files, best regards

addition->https://pjjoint.malekal.com/files.php?id=20171103_k9g10v10r11c14

FRST->https://pjjoint.malekal.com/files.php?id=FRST_20171103_h15k7v13h13l6

Shortcut->https://pjjoint.malekal.com/files.php?id=20171103_j8d5x11f15r6

3 answers

  1.
    Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hello,

    this is a Trojan RAT....

    Here is the fix to perform with FRST. You can refer to this explanatory note with screenshots.

    Open Notepad: Windows key + R,
    In the "Run" field, type notepad and OK.
    Copy/Paste the following into it: 

    CreateRestorePoint:
    CloseProcesses:
     2017-11-02 10:04 - 2017-11-02 10:04 - 000000080 __RSH C:\Windows\SysWOW64\CD88936538.dll 
    Task: {E6D156C5-34D7-46BF-A6E0-C3B05B937B26} - System32\Tasks\gsactwlt => C:\Users\Greg\gsactwlt\llhvy.exe [2016-10-09] (AutoIt Team)
     2017-11-01 13:05 - 2017-11-01 13:05 - 000003562 _____ C:\Windows\System32\Tasks\gsactwlt 
     2017-11-01 13:05 - 2017-11-01 13:05 - 000000000 __SHD C:\Users\Greg\gsactwlt 
     2017-11-01 13:05 - 2017-11-01 13:05 - 000000000 ____D C:\Users\Greg\AppData\Roaming\dclogs 
     2017-11-01 13:05 - 2012-07-12 03:02 - 000044968 ___SH (Microsoft Corporation) C:\Users\Greg\llhvy.exe 
     C:\Users\Greg\gsactwlt
    Hosts:
    EmptyTemp:
    RemoveProxy:
    Reboot:


    Once the text is pasted into Notepad,
    Menu "File" then "Save As",
    On the left, go to the Desktop,
    In the bottom field, file name put: fixlist.txt
    Click on "Save", this will create fixlist.txt on the Desktop.

    Restart FRST and click on the "Fix" button
    A restart may be necessary (optional)
    A text file will appear, copy/paste the content here in a new message.

    Restart the computer.

    2°)
    Finish with a cleanup using Malwarebytes - Malwarebytes Anti-Malware free version tutorial

    AND TO FINISH :
    - Change all your passwords, they have been stolen.
    - Install an antivirus
    - Update Windows 8, you are not on Windows 8.1

    Please press a key to continue the disinfection...
    0
  2. CinquiemeSoleil Posted messages 2 Status Member
     
    I made myself desired, but in any case, a big thank you, everything went smoothly.

    Have a nice day
    0
  3. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    You're welcome and make sure to change your passwords =)

    --
    Please press any key to continue the disinfection...
    0