This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Unknown Remote User Found - How to know what they did?

1 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

This thread's last reply is from July 17, 2018, 1:36 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

dreslick
July 12, 2018, 3:05 PM UTC
Hello!

I came into my house this morning and discovered someone had gained remote access through my VNC server. I scanned the event log and found the ip address to someplace in Romainia. The Command Prompt and Services windows were opened up. This was part of the last command in the command prompt: bitsadmin /transfer script.bat

It had been executed, but I was able to interrupt it with Ctl-C.

How can I know if they changed anything / got into anything?

Here are my FRST Logs.

I have found the script file they were trying to use and can put that here if you think it would be helpful. They were trying to use something called a "miner." Is there anyway to tell if they were successful?

Attachments:

Gary R Administrator
July 17, 2018, 8:39 AM UTC
Your logs show you have software installed that would suggest that this computer is being used for business purposes. Can you please confirm that this is the case.
dreslick
July 17, 2018, 10:18 AM UTC
This is a personal / family home PC. The VPNs are only rarely used.
Gary R Administrator
July 17, 2018, 1:36 PM UTC
It's not the VPNs that made me ask.

The following line ...

() C:\CStone\NMSAccess.exe


.... indicates the presence of ... Cornerstone from IDEXX Computer Systems ... http://www.shouldiremoveit.com/Cornerst ... ogram.aspx

... and this is confirmed by the following entry in your Uninstall list ...

Cornerstone (HKLM-x32\...\{AC85F817-E377-402C-A1A7-F8FED5995508}) (Version: 8.6.12.10 - IDEXX Laboratories, Inc.)


Cornerstone is a program used by Veterinary practices ... https://www.idexx.com/en/veterinary/software-services/cornerstone-software/ ... there is no reason why such software should be found on a home computer.

As far as this forum is concerned, a Veterinary Practice is a business.

May I draw your attention to the topic: ALL USERS OF THIS FORUM MUST READ THIS FIRST, which you should have read before posting for help.

The section here explains why we do not offer help for business computers. Thank you for your understanding.

This topic is now closed.

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.