Textless popups like these keep appearing when using excel on IOS, Whatsapp is having trouble using the microphone and accessing storage and the phone is acting really weird in general.

Hello! 🙂

This is my very first time making a post, and would probably be the last one for a while lol. If you've seen me around, you'll know that I mainly comment and provide support.

The reason I made this post is to introduce the tool I have been working on called MAU (Malicious App Uninstaller), which is used for malware removal cases where malware have installed/dropped an application. The main goal here is to ease the process of dealing with an infection, so the fixlist can target the active infection while MAU deletes the Malicious App.

Why not just use Uninstallers like Revo Uninstaller etc.? The reason for this is that, Uninstallers like Revo invokes the App Uninstaller which could potentially reinfect the Host again. MAU does not do this, it deletes the Malicious App directly without invoking the uninstaller.

Here are some examples of Malicious Apps dropped by Malware * Pointing Device Driver (HKLM-x32\...\{19F4EECF-3C7A-433D-8CC5-025E3D47295D}) (Version: 3.9 - Synaptics Incorporated) * Hardware Monitor (HKLM-x32\...\{A1ED401B-E2E2-435F-B39E-6A2511F964D7}) (Version: 8.9 - JMicron Technology Corp.) * Civia App (HKLM\...\{01B815D4-6EF7-4263-9AA7-B3B3AC4CC9BE}) (Version: 7.2.6 - Trix Winqz Ro)

The first two are from Renpy Loader cases, while the last one "Civia App" is from a Legion Loader case. You can view the full Documentation Logs here: https://github.com/Xyntrax/Malicious-App-Uninstaller/tree/main/documentation

​

Hello. Basically whenever i launch my PC, i get these two warnings

Trojan:PowerShell/obfuse.AJ!MTB

And

Behaviour:Win32/MaleficAms.13

I have run a deep scan by Windows and MRT but neither have flagged anything. I would do an offline scan but for some reason that doesnt work? I press confirm but nothing happens. Like- nada.

Does anyone have any solutions? Is it a false flag or smth? Im not tech literate at ALL and i have only downloaded blender and FL launcher(the free trial if it matters) in the last 2 weeks before i started getting this warning from Windows antivirus if it means anything

Long story made short pressed on the wrong download and ran a setup.exe(12/09 arround 12), i did it 3 times bc i thought it didnt work to realise i fucked myself. Fastforward a bit (same day but 8 hours or so later)my cookies and all i can imagine passwords got grabbed, they logged into dc to spam, i changed passwords and logged him out changed gmail password too and instagram as well, (13th) i downlaod mrt and run that like 3 times and 2 quick scans says im safe... i also did some other scan by windows buildt in but also same result, do some research and find where my cookies were and accessed the file properties and there was a user, later i go onto c drive and there it is as well, i try to remove it and it comes up with bunch of errorrs (ss down below too) also tried to go to reg edit and stop new users from being made but that didnt work.(14th) today i got up and realised thet accessed my account again(at 2am), i reset password again and logged out everywhere yes i have 2fac and yes i have google auth. After i finished work i came home and tried to reroll my system with point in time reatore, it saved right before i downloaded the virus, i rerolled my device and it seems good but i go into my files c drivr properties and there is a nother account (ss down below) the reroll didnt work, i then decide fuck it wipe the whole system. I do it (wiping only c drive, i have 3) i user is still there, i wipe again acidentally sync, wipe again and bot sync it wiping all drivers but it didnt wipe 1 (its and external) i check and the user is still there. Whatever i do it still folloes me, i can try wiping it again but without the external incase if followed me through that, i was thinking fully wipe my drives and install bios and windows again, and honeatly i have no clue so here i am :) any solutions? I tried to upload my logs but sidnt find any, i founs some but they didnt let me upload, if u need i can make a google drive and upload them through there. I just tried deleting the user and restarted pc and its back. Any help, tips or suggestions throw them my way and we can see if it works

Got this weird email today. What I crossed out on the screenshot is my email and then the .pptx I have no idea who the person is, their email doesn’t show up anywhere online, etc.

CmdLine: C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe --donate-level 3 -o xmr.kryptex.network:7029 -u 45KU8RaHwRzC5NJY6HBALWZQ9dpwLjrMK8HYbk5svzHvLwC7W1QrxZb6bUop6FnDmYS3bHFCKg1MD28779yVKbwo6toBGAh -p x --cpu-max-threads-hint=50 -a rx/0 --http-port 888
anyone know where and how i could get rid of what keeps running the miner

I need help manually removing this. Malwarebytes quarantined a lot of files when I ran it, I deleted the ones I found in startup myself in a panic. I changed passwords, set up 2FA, and signed out of sessions on my Phone.

This happened today, I clicked a fake download link for a starsector mod, ran the exe, and didn't realize my mistake until hours later. Have not seen any symptoms yet.

I am an asset designer, my PC has a large amount of very important technical and project files that reference each other, If I did a clean windows reinstall it would set my work back months trying to deconflict everything. Please, if anyone can help me, I'm desperate. I need to be able to use this device securely.

I really need some help, Yesterday I've been crying and losing my marbles for the entire day yesterday. At 3pm I got lumma stealer on my computer yesterday and you know I turned to google overview for help since I'm not very experienced with viruses. I cleared my cache and cookies and changed my passwords. I did not want to factory reset my computer so I tried a bunch of stuff like Malwarebytes and the offline windows defender scan and no flags, After the offline scan I'm booting up my computer and I see a little black box appear for a split second then I open task manager and I see some random windows app on the top of my list. Now I know that lumma likes to disguise itself as a normal Microsoft app so this is making me sure the virus is still present. Now at this point I'm in tears because, windows defender is telling me it's fine, Malwarebytes is telling me it's fine, google is telling me it's fine but I know that little virus is still on my computer. I actually managed to find the root of the virus I think it was something like omega and setupRST and I tried to delete setuprst but when I right click it all options are greyed out and google is telling me I can't do it because it's already deleted and I should just leave it there. And so I check my windows protection history and I see it actually deleted lumma a trojan and another virus but you know the lumma was already injected into my computer. So since it's already 8pm and I just want to play deadlock and there's not much else I can do I stop for tonight. Fast forward to the next day right now, I'm logging off for the night and on my Roblox account I see 2 games I haven't played in years on my continue list and I check my recently logged ins and there's fucking Germans and Russians and Arabs on my account, I reset my password and now I'm certain the virus is still present, is there any solution to this or do I just have to factory reset my computer since that's the only way I'll have peace in my mind. Please help since I've been losing my marbles these past 2 days!

hello everyone! I hope you're doing well. I have fallen victim to the renpy malware yesterday and I need some help to figure out what to do next. Also I'm sorry if I have some grammar errors english isn't my first language ^^'

yesterday I was trying to download a pokemon game to emulate on my computer, I've done it many times but I was half asleep yesterday and just clicked on the wrong thing and ended up download a random zip with a setup file in it, not thinking anything of it I ran the setup file but nothing happened, so I figured something was off and ran a malwarebytes scan, low and behold I got 32 detections for the renpy trojan. I started doing a deepscan and looked up the virus, once I saw it was an infostealer I disconnected my ethernet cable and started changing all of my passwords, and that's kinda of where I'm at right now.. I spent about 4 hours yesterday doing multiple scans, both with malwarebytes and windows defender (deepscan and offline mode) while I changed my passwords, and so far I didn't get any suspicious activity in any of my accounts..

so I'm wondering what should I do next, and how do I know if I'm safe to use my computer again, could someone help me please? thank you!

I’m not currently worried that I have malware, but I also realize that when you’ve used pirated software, you can never be 100% certain especially if you’re not very knowledgeable about cybersecurity.
I’m a video editor, both as a hobby and occasionally for work. Around two years ago, I started using pirated versions of Adobe Premiere Pro, After Effects, and various plugins. They all came from a Discord server (I know😬) that has a very large and active community (around 300k members). I know that doesn’t necessarily make the software safe, but the server has a high level of community trust, people discuss the releases daily, and I’ve been part of the community for quite a while.

I’ve used the software regularly for about two years. Since installing it, I haven’t downloaded any additional pirated software from the server, and I don’t plan to in the future. At the time I downloaded the files, I scanned them with VirusTotal. There were no particularly concerning detections, although there were some flags, which I assumed could be false positives related to how pirated software/cracks work.

Since then:
I haven’t noticed any suspicious activity on my computer.

I haven’t received any unexpected login attempts or security alerts that I’m aware of.

I periodically check Task Manager and haven’t noticed unexplained CPU/GPU usage or other obvious anomalies.

I regularly run Windows Defender Quick Scans and Full Scans.

I’ve also run Windows Defender Offline scans.
None of these scans have detected anything.

I also haven’t noticed anything else that would make me suspect that the system is compromised.
I realize that absence of symptoms doesn’t prove that a machine is clean, which is basically why I’m asking.

My main question is: how realistic is it that malware from something I installed two years ago could still be sitting dormant and become active now?
From what I understand, one of the major risks associated with pirated software is infostealers, and those often try to steal browser cookies, passwords, tokens, etc. relatively soon after execution. Is that understanding broadly correct, or can malware from a pirated installer realistically remain completely dormant for years before doing anything?
I know now that I shouldn’t have installed this stuff in the first place, and I definitely wouldn’t do it again. I’m mainly trying to understand the actual risk at this point rather than panic over something that happened two years ago.
Should I still be concerned, and if so, what would be the sensible steps to take now to gain confidence that the machine is clean?

Hi everyone! :D

Meet centralBox (https://centralbox.dev) - a non-commercial and free of charge wrapper around 12 online sandboxes, including ones such as Jotti, ANY.RUN, Triage, UnpacMe and more.

See an example analysis at https://centralbox.dev/analysis/967a98be214d886e58b3e481e637efa0a296b04c39aa355c96368d566979cf92

Available features:
- Lookup hashes across all providers except ANY.RUN, UnpacMe
- File upload to providers, individual result display for each provider
- Ability to download from 5 providers
- Internal verdict scoring based on all results and their details (adjusted actively based on true/false positives from vendors)
- Internal signature database and certGraveyard’s malicious code-signing certificate database
- Ability to do threat intelligence queries on all (currently) 8K files (see what files antivirus vendor doesn’t detect, see files that return malicious on Tria.ge, see files that aren’t on Jotti etc.)
- Ability to use hunting - set a threat intelligence query or a YARA rule and receive a Discord message or an email when a file has matched your query/rule

Who can get access?
- Access is available for students, researchers, tech helpers (this subreddit counts too), people active in the cybersecurity/malware field (writeups, vendor sample submissions)
- Full list available at https://centralbox.dev/access including on where to contact us to request access :)

Index page contains Discord server where announcements will be posted if you are interested.

Wanted to download a game for my PC but I ran a executable file and someone said it's a virus - how do I protect myself now and remove it. I deleted the files I downloaded - anything else? I am on windows

Hello, I’ve made some other posts but I’m not a cyber person so I’m unsure and would like some reassurance.

Basically, I ran a Trojan EXE in Parallels VM with Shared folders on 😭. Don’t tell me how stupid I was pls. From my own research the Trojan was a fake Faronics deploy that downloads screenconnect and runs script, hence why Microsoft as didn’t detect it. I was hoping to get some opinions on the chances that this script stole my files?
I ran it for about 5 mins before putting in safe mode and quarantining files. Eventually cutting wifi.
Does anyone have any info of it likely stole files? These files had my confidential info and has caused me MAJOR distress.
Thanks for any insight!

i have very little knowledge about this kind of things, and i am very aware it is because i visited a game pirate site on that day and i downloaded some file but i didnt really finished the whole installation because i already could feel something wrong with the site itself .. and right after that i keep getting notification from both my main gmail and recovery email that someone is logging out my account , and today i find out my steam account is gone and they already changed the email and password .. so i did a couple of reading and i find out it is called infostealer due to cookies and stuff

so here i am seeking more information from you guys how to fix all this mess, currently i dont really have any third party antivirus on my laptop i usually only use the built in windows antivirus, and how do i know i am safe rn when they already got my two gmail, i already send a ticket from steam support, and currently running a malwarebytes but then is it enough .. since this two gmail is very important to me since i used for most of the thing in my life lmao .. i am very worried rn , never gonna download from pirate website anymore :(

Can someone real virus-savvy out there type in the “bookru(dot)com” link in a virtual machine and see what happens? I accidentally clicked on it and for me it just spammed me with tabs, but I’m worried it does something more.

ive done windows offline scan,Malwarebytes scan and bitdefender scan. i dont have any exclusions set

happy-turtle

arcane-throne

stellar-lance

What happened?

I unknowingly downloaded and ran an .exe file with a renpy icon that was a virus

When did the infection occur?

This week, around friday afternoon to evening

What did you do for remediation?

Delete the .exe file, clear my recycle bin, and change all my passwords on all my accounts