So i have a exe file , i deleted this file from recycle bin, and then it comes back in few days. I tried every possible method, im not even talking about anti viruses, and still its coming back like a parasite, can somebody help?
#🔒 Exe file comes back after deleting it
teal onyx
glass wharfBOT
So i have a exe file , i deleted this file from recycle bin, and then it comes b...
@teal onyx
Python help channel opened
cobalt flax
@true saddle want to take a look?
rapid isle
whats the file path of the exe?
teal onyx
Downloads
teal onyx
U want the name of f that exe file?
rapid isle
yes
cloud marsh
ok that's it
teal onyx
Its from discord groups
cloud marsh
/s ban connor
teal onyx
ok that's it
Fuck off bro
noble lily
it's probably getting put back by a script somewhere (maybe a scheduled task, see if any of them look suspicious) but you'll maybe need someone who knows a bit more about how these things work to look at it
teal onyx
it's probably getting put back by a script somewhere (maybe a scheduled task, se...
Could it be a miner ?
rapid isle
does the task manager show a lot of cpu usage
teal onyx
No
teal onyx
Nothing changed, just the exe file comes back after removing
rapid isle
hard to really say what the malware does or how to remove it
noble lily
could just be a token grabber or smth I guess. I'd say to check Task Scheduler to see if there's a task that puts the file back
and remove it
teal onyx
Nothing changed, just the exe file comes back after removing
When i removed it 2 or 3 days its not there, but in like 4 days its there again
rapid isle
do you still have the original installer
teal onyx
Original?
rapid isle
yeah, presumably you downloaded an installer? like a .msi file
teal onyx
yeah, presumably you downloaded an installer? like a .msi file
No, it was only exe
noble lily
When i removed it 2 or 3 days its not there, but in like 4 days its there again
did you check Task Scheduler for malicious tasks? Task Scheduler on Windows allows you to set some code to run on some schedule (or when triggered). It is sometimes used by malware to persist the malware (make it come back once deleted)
rapid isle
if you're curious you can try scanning stuff here https://www.virustotal.com/gui/home/upload
noble lily
No, it was only exe
.exe can be an installer, what did it do when you first ran it?
teal onyx
I opened my task manager and i see 1% using but it shows me 13 and 22% very quick
noble lily
I opened my task manager and i see 1% using but it shows me 13 and 22% very quic...
not task manager, task scheduler
teal onyx
Can i stream for you
noble lily
different thing
noble lily
search "task scheduler" in the start menu, click it when it comes up
noble lily
if you click "task scheduler library" at the side, you should see a list of tasks in the middle of the screen
you can expand the section so you can read everything
teal onyx
Yea i see one drive, i was on internet, they said one drive can do smthing with it
noble lily
one drive is normal
do you see anything with a "created" date the same as the day you installed it
teal onyx
Yea but they said it can affect these type of things
oblique egret
What does Windows Defender say about it?
teal onyx
do you see anything with a "created" date the same as the day you installed it
I deleted this exe file multiple times and the data changed
noble lily
do you remember when you first clicked the exe?
teal onyx
No
noble lily
hmm what scheduled tasks do you have (aside from onedrive)?
unless the publisher of the OneDrive one is not Microsoft, in which case it's sketchy
noble lily
ok nothing wrong there
idk what else to look for, you might have to find someone who knows more to look at your PC
teal onyx
But what if i delete one drive in task schedules
noble lily
then one drive won't work anymore
also probably find a virus scanner and run it
maybe even Windows Defender, do a deep scan. And maybe another mainstream virus scanner too
teal onyx
also probably find a virus scanner and run it
Like i said i did this, and stil..
Did this with windows defender it shows nothing
wintry lichen
Did this with windows defender it shows nothing
Do you happen to have the download link open in a tab in your browser?
teal onyx
No
I mean if somebody wants really solve the problem i can send this exe, but its probably 100% virus
teal onyx
Btw, from that exe installer i installed files into program files, maybe after deleting the installer, some files which i installed from installer are creating like new installer in the downloads path, can it be like this?
@noble lily what do you think
glass wharfBOT
Python help channel closed