Hey guys I could really use your help here. The other day I downloaded a cracked software and when I attempted to install it I got malware. I only realized when I work up one morning and discovered that my debit card got used for like $20 that I didn’t do. I found they used any desk on my computer and then used my browser to access my G2A account.
After realizing what had happened I tried to run a full windows defender scan and a full malwarebytes scan but I turned up nothing.
They came back again this morning using rust desk. This time I went into the windows firewall tool and found the any desk and rustdesk entry and removed them.
I am really trying to avoid nuking my windows install. I leave my computer on 24/7 because atm it’s all I have to run my plex server… Anyway your help would be greatly appreciated
Malware is financially motivated these days and at least 2 devices are needed: one for gaming with illicit sources that is completely offline and will never go online and another device for your general usage.
If it has to be all within one machine I suggest you stop pirating and just buy games during sale.
Run malwarebytes in safe mode, some malware is designed to hide itself when certain processes are active. If it finds something though, that may not be the entirety of it.
But pretty much what both @thetazman and @Log said is correct. After new OS is installed, change every single one of your passwords/tokens and revoke any active session for anything logged in.
There’s currently only one known active person who’s cracking denuvo for games with a cult-like following. Ironically the cracker includes their own version of DRM with their cracks. Whomever that is either unhinged, a troll, or a combination of both. I am waiting for the day something happens with computers that have installed those copies of cracked games.
I definitely want to second NightMoose’s fantastic point that you need to change every password you have now, and log out of every website you visit. Assume the attacker now has a copy of your browser profile, and knows what websites you go to, their passwords, and has tokens that give them access without logging in. If you stored credit card info for quick entry fill, that’s also a possible risk.
If you have/had sensitive personal or financial information on the drive, you should assume they have those as well and think about how they could exploit them.
While it’s best to have a separate machine for this sort of thing, that you can wipe and reinstall without consequence, another way you can protect yourself in the future is setting up a VM for those sorts of things on top of a linux distro. You should then delete the VM once your done with it so you don’t forget that it possibly has malware and accidentally use it
Using SPICE for USB pass-through is easiest as it doesn’t require any elevated permission, start Quickemu with --display spice and then select Input → Select USB Device for redirection from the menu to choose which device(s) you want to attach to the guest.
About five years ago I got infected by malware, I was downloading the trial version of Nero from its web site. I went to install what I thought was the trail version of Nero, instead it was malware. I could tell right away something was off, I lost control of my computer. So I ran some anti malware software to remove the malware. I got back control of my computer, but I did not chace the password to any of my accounts because I thought there was no way my accounts could be hacked, because I got rid if the infection before my accounts where hacked. I was wrong. My facebook account had been hacked, but I did not know my facebook account had been hacked untill three months later. Three months after the malware infection I noticed some facebook post posted as me but I did not write them. So Instead of dealing with Facebook to get back control of my facebook account. I just closed my account. I hope @Linux_Noob takes my cautionary tale to heart and does the right thing, either completely wipe his system or installa new drive in his computer.
Not trying to fearmonger or anything, but you’ll also need to be aware about the concept of nuking here.
Just reinstalling windows, while reformatting the disk might not be enough. It’s known for some time that malware can also be hidden in BIOS/UEFI too. References below:
So besides reformatting the PC, you should also compare the BIOS you have against a clean version downloaded from the manufacturer.
I’m not sure if a clear CMOS/UEFI would be necessary as well, but it wouldn’t hurt.
My strategy has been to perform frequent boot drive mirroring and to keep these mirror images going back years. Disk space is cheap nowadays. Bad software install? Blast the boot drive and restore a mirrored image before the nastyness. Something misbehaving, but you don’t know exactly when the cause occured? Blast the boot drive and restore a mirror from a month or two prior. In my case, this has always stopped problems. Software updates almost always happen automatically, so within a few hours everything is as it was before any nastyness. I also perform less frequent mirrors of my other drives, so those too can be blasted and restored if needed. At worst, I might have to reinstall a package.
Definitely unplug from the network. Just for info, malwarebytes has a portable install so you can run off a USB. What I would recommend is to get a Hirens PE USB setup (on another PC, obviously) and boot into that environment. This will make your infected OS drive a regular hdd and the contents should be inactive. Nothing should be in use on that drive, so everything should be scannable. Then run the malwarebytes on the infected drive from a USB. Once a PC gets infected, I don’t trust that OS again until I’m sure it is 100% cleaned up.
If MWB fails to clean it up, then format (and I mean format with a mil spec HDD formatter that rewrites every single byte at least twice) the drive. Turn it off, unplug for at least 60 seconds (Remove or disconnect the battery if a laptop), then plug back in and reinstall Windows.
If you make a habit of this you are going to be spanked again. This time, it’s just an infection. Next time could be ransomware and you can lose access to everything. There’s lots of Open Source software out there that covers 99% of what commercial software does. Most companies have sales on keys, if you’re patient enough. When you play with the dark web, the dark web can play with you.
You really should avoid cracked software, but if you can’t then at least make sure you download from sources that have some systems in place let you assess what you’re downloading, like hashes and comment sections.
and as others have said, having a separate machine for your online shopping, emails etc is a really good idea
windows defender letting malware run on your pc no problem, meanwhile I’m fighting tooth and nail to stop it from scanning my transfers and locking up my OS when my nas nic stops working
Have you tried running scans in Safe Mode? Sometimes malware can hide from scans in normal mode. Also, consider using additional tools like HitmanPro or Spybot Search & Destroy—they sometimes catch things that others miss.
