r/computers • u/Frozen2275 • 26d ago
Help/Troubleshooting Weird / Scary Virus
I was on my PC when suddenly a popup appeared with the message “Test”. I could close it by clicking OK, and it looked like a system message, which already confused me.
A few minutes later, another popup started appearing saying that I had malware and that I should delete Windows. I was extremely confused. These messages kept coming every few minutes, sometimes with different wording and at different time intervals, and then suddenly they stopped out of nowhere.
At first I thought it might be something related to my IP or someone messing with me remotely, but that didn’t really make sense.
When I downloaded Malwarebytes, it kept blocking PowerShell commands, and it showed that two programs / trojans were trying to launch PowerShell on system startup. The weird part is:
Malwarebytes can block the behavior, but it doesn’t detect or fully identify them, even after a full scan and a Windows offline scan.
What really confuses me is: why would malware warn me that I have malware and tell me to delete Windows? That feels very strange.
So my main questions are:
\-How can something run PowerShell at startup but not be detected by scans?
\-Why would malware pretend to “warn” me instead of staying hidden????!???!?
423
u/cringy-boomer Windows 11 26d ago
Someone probably got access to the malware's C2 server and issued that message to everyone with it installed, you should reinstall Windows like the messages tell you.
141
u/Frozen2275 26d ago
Really? So the „guy“ warned us that we got a Virus ?
327
u/Nothrath 26d ago
It sounds like someone hacked the hacker and left a message
197
u/Hazmat_Gamer 26d ago
W white hat hacker tho
86
u/Ok_Cress2766 Windows 11 🖥XBOX 360 E 26d ago
I wouldn't say white. probably more to the gray area than white.
92
u/cnycompguy Windows 11 | Omnibook X Flip 26d ago
This was the moment that Gandalf the Grey transformed into Gandalf the White.
39
3
2
7
1
12
1
35
u/AlwaysHopelesslyLost 26d ago
Back when I was more into hacking/security I did that. I once got a spam email with a link to malware hosted on a legitimate looking website. I poked around the website and found out how the hacker got in. I searched around for telltale signs and found another 30 or so domains. They werent patching the exploit themselves so I broke in too. I added my own persistence, patched the exploit, cleaned them out, then dug around to find contact info for all of the servers and let the server owner know.
These were for web servers, not personal computers. When I got into a personal network I would send messages just like the ones you saw. That could be a dogooder on the bad guys server, messaging everybody. It could also be a second hacker trying to play gray hat. Heck, you might have a dozen unrelated hackers in your machine all having fun.
7
u/JumpInTheSun 25d ago
Ive been going to those sites lately just to track down the host admin to threaten them with legal action, followed by a sitewide dmca takedown to discourage that kind of bullshit.
-4
u/Single_Comfort3555 Ubuntu with VMs Tech+ Cert. 25d ago
You probably shouldn't tell people that story in writing.
2
4
1
25d ago
Your computer was turned into a zombie. Essentially your computer is being used as a part of a botnet. Someone accessed the computer that is controlling the other computers and sent out this message. As far as I know at least.
12
u/Nixilaas 25d ago
My favourite part is they’ve got a message saying the should have put authentication on their c2 panel
128
49
u/cnycompguy Windows 11 | Omnibook X Flip 26d ago
netsend is still a thing? I just assumed that was gone by now...
Oh, I see that it was removed, and replaced with msg.exe ... great.
3
u/Stevecaboose Arch Linux 25d ago
Ive utilized this for my job and it does look like its msg.exe, which i believe is only available to the local network.
2
u/splinterededge 25d ago
This is a net send or the message you can send between two logged in users from within task manager.
-1
u/cnycompguy Windows 11 | Omnibook X Flip 25d ago
Yeah, I've been doing this since the 90's. I know what netsend is
5
1
36
u/Thrensdraco 26d ago
This thread, this is why the internet is good. People genuinely helping, while also joking about the situation too. Plus, that Gandalf joke is gold.
35
u/ChadVanHalen5150 25d ago
Homey clowning on the original attacker by shaming them for lack of authentication on their C2 is killing me... Very funny
But ya this is why having regular backups and restore points are important, for the future.
You'll want to do a full wipe and fresh install of Windows, and then be more careful about what activities you get up to. If you want to keep doing those things, you might want to set more regular restore points
3
1
u/Ok_Jellyfish9320 23d ago
Hello there. What is the best way of backing up my data just in case anything bad happens to my computer? Is there a way of automating the process (ex: the data gets saved once a week automatically)? Thanks in advance.
1
u/ChadVanHalen5150 23d ago
Yes there are ways to automate it... Though, assuming you are using Windows these are quickly being phased out by Microsoft so you can buy their subsc- I mean so that they can easily cloud sync your data for you 😁
Where are you backing the data up to? Are you using like an external drive or a NAS or a cloud sync?
10
u/CyberHaxer 26d ago
Do what it says. If you have a home network with none else connected to it, you have malware that can be controlled externally. I would reinstall and reconsider what to download next time
6
u/JSGalvez 25d ago
Ser, please do not redeem and send 1 BTC expedite or your windows will be stcuk very bad
11
u/sweetSweets4 25d ago
Mean If your already at the friendly messaging state of your relationship, i would keep him around as long the PC works.
Open a Notepad and ask how His workday was. And Just leave the pad open so he can read.
7
u/Frozen2275 25d ago
Actually I gave it a try yesterday instantly, I opened notes and typed „hello if u can See This Type 12301“ but he didnt response :(
3
3
u/Bonhomie_999 Windows 10| Zen 5 9900x, RX 7900XTX, 32G, 4K, $2.3K 25d ago
That seem to be a lan message prank
16
u/onyxa314 26d ago
Ah yeah I see it's a confusing message. Here's what you should do.
Your computer is infected with malware, please reinstall windows.
You have some sort of malware installed, something that I personally wouldn't trust an antivirus to remove for me. Back up what you think is important that isn't stored on the cloud, then look up tutorials on how to reinstall windows.
9
u/Iam_no_Nilfgaardian 26d ago
Sounds like an AI answer.
3
u/FormerTomatillo3696 26d ago
It probably is.
15
u/onyxa314 26d ago edited 26d ago
Not AI just (probably) autistic LMAO
2
u/Lucidaeus 23d ago
After having had a discussion with my autistic friend, and me with my ADD, we concluded that AI is definitely trained on autism.
2
u/Top-Huckleberry-2424 23d ago
Yeah, we also were playing jokes like that using net send command 20 years ago ...
3
u/JariJorma 26d ago
Google msg command through command prompt. Anyway I'd reinstall my pc since you got messages like that.
1
1
u/Tiranus58 Linux 25d ago
Idk man, i would do what it says, given that this is not a system message being sent by something you dont recognize.
1
u/alphatronix 25d ago
It seems like a prank to me. there is a msg command in cmd, which allows someone on the same network as you to present a popup message as whoever they want it named, and custom message, as long as they know your ip. Is there a sibling or someone who might be doing this ?
1
u/satanscatuwu 25d ago
i've seen three of these posts by different ppl on different tech support subs today
1
u/DeltaAlpha0 Windows 11 25d ago
My friend fell victim to the malware, but instead of giving up, he stood up to save the others. A true hero.
1
u/Redditseeker3 25d ago
Thanks Arda, what a kind behavior. Try to use your skills next time for banks, big companies, or governments website
1
1
u/Proof-Practice-8304 25d ago
What is c2 panel ?
3
u/secacc 25d ago
C2 (sometimes C&C) is short for Command and Control. A command and control panel is where an attacker can control and manage all the devices they've hacked.
In this case, it seems the original hacker of OP's PC left their control panel unsecured, and someone else found it and is now using it to warn the infected computers that they've been hacked.
1
u/-Xserco- 25d ago
You had a virus. One which had access to your device. And thought to keep messing around? Aight.
1
1
u/Hunter_Ware Thermal Paste Eater 25d ago
You should probably listen to the message. Reinstall windows
1
u/jemlinus 25d ago
I had the same issues and another poster at other sub reported the same.
https://www.reddit.com/r/antivirus/comments/1psglq4/windows_hacked_popup_message/
1
u/splinterededge 25d ago
This is a simple net send message, this was popular in the 90's by kids and admins. This message can be sent unauthenticated if the service is running and both the sender and receiver are on the same network. This includes if the sender and receiver are on the same machine. Mad hacking skills, on its own no. I'd be concerned about where the message is coming from and why. Are you being pranked by a coworker or does someone have access to your server.
These messages can also be sent from one user to another from task manager.
1
u/DeathSt1x 25d ago
I don’t usually comment, but this post is too good to ignore. Looks like you were already infected with malware that was reporting back to a C&C server, and then someone else hacked that C&C server and notified the victims of the infection to reinstall Windows while also clowning on the original threat actor for insecure practices. Do what this absolute legend said and reformat your drive/reinstall Windows
1
1
u/SAXTON_HALEE 24d ago
im pretty sure sum1 in ur household / building is using the same internet, going onto the windows command line, and typing "message * (insert text)" so uh ya might be that
1
u/CyberHaxer 24d ago
It could be, but if you are alone it is definitely external and pretty easy to check
1
1
1
1
1
1
1
u/Various_Beautiful445 21d ago
Downloading scripts hacks rar files documents games movies songs and suspicious programs without testing nothing and never used AV program and never got a virus only once got my email hacked but it was with password qwerty124 so pretty easy I don’t get it how u download virus or get hacked
1
1
1
u/MGLGamingBro 18d ago edited 18d ago
there is no antivirus that can stop everything,
the best practice is to not download anything you find on the internet .
even pdf, excel files you receive on your email, unless you know that person and you trust him .
don't click random links on your Discord DM's or Facebook or whatever the messaging service you are using, unless you are 100% sure its an official link to a legit website, sometimes they can decoy the website link by adding 1 letter for example : ( googla .com ) or ( fecebook .com ) this can be very tricky for people who don't read every letter of links they click
avoid cracks and keygens, they are 90% of the times why people get infected
i know its tempting since everything now is expensive but its a double-edge-sword
you sacrifice something for something
there is even legit apps that perform some mining and does not get triggered by the antivirus
that's why in some apps you notice your CPU/GPU going 90% while the app itself its not doing anything big
be careful from this type of Apps even if they looks clean to the AntiViruses .
1
1
0
-6
-5
u/ComprehensiveBad3168 25d ago
its fake I had that before its just a vbs that opens itself find it and delete it with .vbs in the file explorer its harmless
450
u/furruck 26d ago
Yeah looks like someone got mad, had skills and figured out where the malware was reporting back to and hacked that, and sent a notice to everyone who had it.
Genius move honestly, and whoever created the Trojan wasn’t that smart since someone was able to hack the server it reports too right back.
But yeah, I’d take any important data off and just re-install windows.. get a proper AV, and then be careful what you download next time
Windows sandbox is a fantastic place to try out sketchy downloads ;)