Dont know if i successfully removed malware. | Linus Tech Tips | Page 1

storm brook Jul 26, 2023, 6:49 PM

#

I have downloaded a program from a user on discord who i knew (he probably got hacked)

I ran it and it started a command prompt with a loading bar and nothing else. When it got close to the end Defender quarantined a program called spooler in the windows folder. I deleted it, the action was succesful. I have deleted the folder that the program came in. I am doing a Kaspersky full scan right now. Sould i be worried that my PC is still infected? Since then i havent noticed anything suspicious, cpu and gpu usage is normal, none of my accounts have login attempts.

Kaspersky and hitmanpro hasnt found anything

tender blade Jul 26, 2023, 7:21 PM

#

Burn the drive and get a new one 🤣

storm brook Jul 26, 2023, 7:46 PM

#

tender blade Burn the drive and get a new one 🤣

bruh lmau

rancid spire Jul 27, 2023, 12:50 AM

#

storm brook I have downloaded a program from a user on discord who i knew (he probably got h...

You should try looking in Task Manager if something suspicious is running in background. Also check if there is anything that you don't know in your Program files, or temp folder.
I remember that by uploading the malware in VirusTotal, you could see exactly what's the virus doing (and so the folders that it tries to install itself to)

storm brook Jul 27, 2023, 12:50 AM

#

rancid spire You should try looking in Task Manager if something suspicious is running in bac...

nothing suspicious there...

#

they said it could maybe inject itself into ther files tho

rancid spire Jul 27, 2023, 1:05 AM

#

The most simple way to be sure that you got rid of the malware is to re-install Windows completely, or, even safer, get a new disk and destroy/never use the old one again

fluid wyvern Jul 27, 2023, 1:10 AM

#

Did you do a full virus scan?

#

With all the settings on so it checks everything?

urban whale Jul 27, 2023, 1:11 AM

#

I believe using AutoRuns to check if the virus is starting is a good idea
https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

Autoruns for Windows - Sysinternals

See what programs are configured to startup automatically when your system boots and you login.

#

Literally shows everything that is starting with Windows.

fluid wyvern Jul 27, 2023, 1:12 AM

#

Or you could do a boot scan

#

That might actually be the same thing that we’re talking about

storm brook Jul 27, 2023, 1:34 AM

#

fluid wyvern With all the settings on so it checks everything?

yes both with defender and with kaspersky

#

and hitmanpro

fluid wyvern Jul 27, 2023, 1:34 AM

#

Huh. That should have removed the malware

storm brook Jul 27, 2023, 1:34 AM

#

didnt find nothing

fluid wyvern Jul 27, 2023, 1:35 AM

#

Yeah, then I doubt the problem is malware

storm brook Jul 27, 2023, 1:35 AM

#

well i dont have a problem really

#

im just paranoid

urban whale Jul 27, 2023, 1:36 AM

#

reasonable.

storm brook Jul 27, 2023, 1:36 AM

#

cus they say once u launch it it spreads

#

all tru the system

fluid wyvern Jul 27, 2023, 1:36 AM

#

Do you have a computer that you could afford losing?

urban whale Jul 27, 2023, 1:36 AM

#

it depends on the virus...

storm brook Jul 27, 2023, 1:37 AM

#

fluid wyvern Do you have a computer that you could afford losing?

nope

fluid wyvern Jul 27, 2023, 1:37 AM

#

Huh

storm brook Jul 27, 2023, 1:38 AM

#

i only have one

urban whale Jul 27, 2023, 1:39 AM

#

well if you have A AntiVirus running you should be fine, consider checking the programs that start with Windows and you should be good for the most part..

urban whale Jul 27, 2023, 1:39 AM

#

urban whale I believe using AutoRuns to check if the virus is starting is a good idea https:...

.

storm brook Jul 27, 2023, 1:39 AM

#

urban whale .

downloading that rn

#

how is cmd.exe not a verified program

#

bruh

urban whale Jul 27, 2023, 1:41 AM

#

uh

storm brook Jul 27, 2023, 1:42 AM

#

this was installed before the virus tho

urban whale Jul 27, 2023, 1:42 AM

#

consider dism /Online /Cleanup-Image /RestoreHealth and sfc /scannow

storm brook Jul 27, 2023, 1:43 AM

#

now im not good at this what do those do

#

and where do i do those

#

if you mind explaining

urban whale Jul 27, 2023, 1:43 AM

#

sfc = system file checker

#

so it checks for system files that might be corrected and attempts to fix them

#

dism is uhh... it basically checks for windows image file corruptions and fixes them too..

storm brook Jul 27, 2023, 1:44 AM

#

i should do these in command prompt right?

urban whale Jul 27, 2023, 1:44 AM

#

administrator one, yes.

storm brook Jul 27, 2023, 1:44 AM

#

alright, thanks

#

what is this hlkm thing tho

urban whale Jul 27, 2023, 1:45 AM

#

well

#

I guess you could navigate to the reg location and check it

#

take a screenshot and I might be able to help.

storm brook Jul 27, 2023, 1:46 AM

#

#

has stuff like this too

storm brook Jul 27, 2023, 1:46 AM

#

urban whale I guess you could navigate to the reg location and check it

ok

urban whale Jul 27, 2023, 1:47 AM

#

storm brook

check for unverified first, I would say that's the most important!

storm brook Jul 27, 2023, 1:47 AM

#

#

ton of unverified stuff

urban whale Jul 27, 2023, 1:47 AM

#

dism should fix most

storm brook Jul 27, 2023, 1:47 AM

#

but my antivirus in there too

#

should i run this (dism /Online /Cleanup-Image /RestoreHealth) whole thng at once or once per slash?

#

im sorry im a noob

urban whale Jul 27, 2023, 1:49 AM

#

all

#

it's the arguments

#

they have to specified else dism doesn't know what to do.

storm brook Jul 27, 2023, 1:50 AM

#

ok its doing something its on 3 percent

urban whale Jul 27, 2023, 1:50 AM

#

ye ye, just let it do its thing!

storm brook Jul 27, 2023, 1:51 AM

#

when i try to click here

#

i get this

urban whale Jul 27, 2023, 1:51 AM

#

it's a registry key..

#

open regedit and try to navigate to the key specified...

#

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers

#

paste this on the regedit path

#

up here

#

and take a screenshot of what keys there are.

storm brook Jul 27, 2023, 1:53 AM

#

when i do that

#

i just get an error sound

#

and it puts me back where it started

urban whale Jul 27, 2023, 1:53 AM

#

what about this: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

storm brook Jul 27, 2023, 1:54 AM

#

ooh

#

the delete all

#

didnt delete the computer part

#

from the beginning

urban whale Jul 27, 2023, 1:54 AM

#

hm

storm brook Jul 27, 2023, 1:54 AM

#

so it was like this Computer\Computer\

urban whale Jul 27, 2023, 1:54 AM

#

Unlucky

storm brook Jul 27, 2023, 1:55 AM

#

urban whale Jul 27, 2023, 1:55 AM

#

weird

#

nothin'

#

did dism finish yet?

storm brook Jul 27, 2023, 1:57 AM

#

ok now ihave a windows thats activated by "MAS" this is just that right?

#

also i think it matches the activation date

urban whale Jul 27, 2023, 1:57 AM

#

uh

storm brook Jul 27, 2023, 1:57 AM

#

so i didnt buy a real key

#

i didnt do the process

urban whale Jul 27, 2023, 1:58 AM

#

well

storm brook Jul 27, 2023, 1:58 AM

#

a friend of mine did

urban whale Jul 27, 2023, 1:58 AM

#

storm brook ok now ihave a windows thats activated by "MAS" this is just that right?

Well my pc doesn't have this file..

#

sus

storm brook Jul 27, 2023, 1:58 AM

#

well ur pc has legit windows right?

urban whale Jul 27, 2023, 1:58 AM

#

yes

storm brook Jul 27, 2023, 1:58 AM

#

then i thnk its just that

urban whale Jul 27, 2023, 1:58 AM

#

oh well

storm brook Jul 27, 2023, 1:59 AM

#

cus he said its somehow cracked

#

cus we didnt pay

urban whale Jul 27, 2023, 1:59 AM

#

no comment

storm brook Jul 27, 2023, 1:59 AM

#

#

this finished

urban whale Jul 27, 2023, 1:59 AM

#

what about dism?

storm brook Jul 27, 2023, 1:59 AM

#

55

storm brook Jul 27, 2023, 2:00 AM

#

storm brook

found corrupt files

#

weird

#

#

ok this done too

urban whale Jul 27, 2023, 2:00 AM

#

alright restart.

storm brook Jul 27, 2023, 2:01 AM

#

ok then brb

#

k im done

urban whale Jul 27, 2023, 2:05 AM

#

check autoruns

#

if most of them are ok now!

storm brook Jul 27, 2023, 2:06 AM

#

def less

#

but still quite a éot

#

lot

#

#

like all these

urban whale Jul 27, 2023, 2:07 AM

#

I don't think you're gonna be able to do anything about those..... they most likely have no license..

#

signature*

storm brook Jul 27, 2023, 2:08 AM

#

yeah

#

when i run law

#

it says unknown publisher

#

#

what are these

#

thinking

#

and why they not found

urban whale Jul 27, 2023, 2:10 AM

#

that's not an issue by itself...

storm brook Jul 27, 2023, 2:10 AM

#

oh ok

#

well defenetely way less unverified stuff that i dont know what they are

urban whale Jul 27, 2023, 2:11 AM

#

syswow64 is just the compatibility layer between 32-bit applications and the system.

storm brook Jul 27, 2023, 2:11 AM

#

oh

urban whale Jul 27, 2023, 2:11 AM

#

just make sure you have antivirus on, and you should be 10/10.

#

always be sus of every application you download.

#

signature is ez verifier of non-virus applications.

storm brook Jul 27, 2023, 2:12 AM

#

Defenitely wont be launching random exe-s after this

#

thanks for the help i appreciate it🤍

#

gonna go sleep its 4 am here

#Dont know if i successfully removed malware.