Struppigel

Fabar Recovery Scan Tool (FRST) is a powerful tool that can cause serious issues if used incorrectly. Only approved users should offer to create fixlists.

Message the mods if you have experience with FRST and would like to use it to help on posts.

To anyone who is receiving help, please verify that the person providing fixes with FRST is in the list below. Be aware that running Fixlists from anyone else is potentially dangerous.

• u/FFreestyleRR
• u/No-Amphibian5045
• u/rifteyy
• u/struppigel

For anyone who is affected PCAppStore infection -- it would help us if you could obtain C:\Program Files (x86)\PCAppStore\EventsViewer.dll

If you do, please upload it to VirusTotal.com and post the link. Thank you very much.

--------------------------

If you are looking for remediation options, to our knowledge the screenlock does not work without Internet connection. So unplug your Internet cable or power off your WLAN router temprorarily, restart the computer and you should be able to access everything.

At this point, if you want to do us a favor, copy and paste the aforementioned EventsViewer.dll from C:\Program Files (x86)\PCAppStore to the desktop.

Then uninstall t

Some time ago there was a help request post on r/antivirus about Pivigames spreading malware. We looked into it.

After weeks of reversing we have now published a blog post about HijackLoader.

For HijackLoader we provide tools to:

• resolve API, process, and module hashes
• decrypt stage 2
• decrypt the configuration and extract module table entries
• extract and decrypt the payload