pvcp Posted October 30, 2023 ID:1597316 Share Posted October 30, 2023 I downloaded and ran an exe file from torrent and now my computer is full of malware. I can't open Malwarebytes website to download Malwarebytes anti-malware software. Thanks for your help in advance! Link to post Share on other sites More sharing options...
Porthos Posted October 30, 2023 ID:1597341 Share Posted October 30, 2023 @pvcp Let's get the info to get the process started. Please do the following so that we may take a closer look at your system for any possible infections. Do these 2 steps so that ALL folders & Files are set to SHOW, plus also, Turn OFF Windows Fast start. Show-Hidden-Folders-Files-Extensions https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/ Disable-Fast-Startup https://forums.malwarebytes.com/topic/299350-disable-fast-startup/ Then please restart the computer and do the following. WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system. Download the Malwarebytes Support Tool In your Downloads folder, open the mb-support-x.x.x.xxx.exe file In the User Account Control pop-up window, click Yes to continue the installation Run the MBST Support Tool In the left navigation pane of the Malwarebytes Support Tool, click Advanced In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine A zip file named mbst-grab-results.zip will be saved to the Desktop or on the hidden Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply Then be patient for the next expert to take your case. Thank you Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 30, 2023 ID:1597435 Share Posted October 30, 2023 Hello @pvcp My hunch is that your browser will also be prevented from getting the support tool. My hunch is that there is a major multi-pronged disablement of many security tools & security sites. Let's do one special run with Malwarebytes Adwcleaner. It will not take much time, Read over all lines before starting so that you have a good understanding of the whole method. Take your time and go careful. I ant to make sure you select all of what I list below - before- pressing the "scan" button. First download & save it this link Then go to where the EXE file is saved. Start Adwcleaner. Do not rush. There are a few first choices to set as I have listed below. Reply YES at the Windows prompt to allow the program to proceed and make changes. That is the usual Windows security prompt. When AdwCleaner starts, on the left side of the window, click on “Settings” and then enable these repair actions on that tab-window by clicking their button to the far-right for ON status Delete IFEO keys Delete tracing keys Delete Prefetch files Reset Proxy Reset IE Policies Reset Chrome policies Reset Winsock Reset HOSTS file ONLY after you have set the selections above ....only after that ..... Now On the left side of the AdwCleaner window, click on “Dashboard” and then click “Scan” to perform a computer scan. This can take several minutes. When the AdwCleaner scan is completed it will display all of the items it has found. Click on the “Quarantine” button To remove what it found. AdwCleaner will now prompt you to save any open files or data as the program will need to close any open programs before it starts to clean. Click on the “Continue” button to finish the removal process. Guide article Attach the clean log from Adwcleaner when all completed. For example AdwCleaner[C00],txt There is much more to do even after this. Link to post Share on other sites More sharing options...
pvcp Posted October 30, 2023 Author ID:1597437 Share Posted October 30, 2023 i fixed it myself Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 30, 2023 ID:1597438 Share Posted October 30, 2023 What did you fix and how ? Link to post Share on other sites More sharing options...
pvcp Posted October 30, 2023 Author ID:1597439 Share Posted October 30, 2023 i had figured out i had STOP/djvu and just ran tron and manually reset the hosts file but my files are still encrypted sadly but atleast I dont have to worry about it anymore Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 30, 2023 ID:1597442 Share Posted October 30, 2023 STOP/djvu is a encrypting ransomware. The best way to get back the damaged encrypted files is from a previously made offline Backup. We here have nothing to cure any encrypted user files. The Bleepingcomputer forum has a lot of details on various ransomwares. For the STOP djvu see this informational article Is there any other help you need? Know that encrypting ransomwares do delete all Restore Points on Windows. Such that one cannot use a System Restore point, because they are mass deleted. Also, the System Restore service will be disabled. Likely other services compromised. Link to post Share on other sites More sharing options...
Maurice Naggar Posted November 5, 2023 ID:1598359 Share Posted November 5, 2023 I am marking the case for closure. Consider using PatchMyPC, keep all your software up-to-date - https://patchmypc.com/home-updater#download Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware. SAFETY TIPS: Backup is your best friend. Keep backups of your system on a regular basis to offline storage & keep those safe. https://forums.malwarebytes.com/topic/136226-backup-software/ It is not enough to just have a security program installed. Each pc user needs to practice daily safe computer and internet use. Best practices & malware prevention: Follow best practices when browsing the Internet, especially on opening links coming from untrusted sources. First rule of internet safety: slow down & think before you "click". Never click links without first hovering your mouse over the link and seeing if it is going to an odd address ( one that does not fit or is odd looking or has typos). Free games & free programs are like "candy". We do not accept them from "strangers". Never open attachments that come with unexpected ( out of the blue ) email no matter how enticing. Never open attachments from the email itself. Do not double click in the email. Always Save first and then scan with antivirus program. Pay close attention when installing 3rd-party programs. It is important that you pay attention to the license agreements and installation screens when installing anything off of the Internet. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed. Take great care in every stage of the process and every offer screen, and make sure you know what it is you're agreeing to before you click "Next". Use a Standard user account rather than an administrator-rights account when "surfing" the web. See more info on Corrine's SecurityGarden Blog http://securitygarden.blogspot.com/p/blog-page_7.html Only using the Standard-access-level user account when surfing and downloading / installing would have been a tremendous way to prevent the infections of this machine. Don't remove ( or change ) your current login. Just use the new Standard-user-level one for everyday use while on the internet. Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware. For other added tips, read "10 easy ways to prevent malware infection" Stay safe. Link to post Share on other sites More sharing options...
Recommended Posts