[SOLVED] Computer virus is active, but can't find it.

Tashogeorgiev

Reputable
Dec 7, 2016
22
0
4,510
Recently my computer got infected with a virus, which encrypted all my files with a .zzla extension and demanded a payment to get them back. Since all my valuable data was backed up, i decided that i would just reset windows entirely and it would kill the virus.

I reset it from the settings, and selected the option to delete everything on the drives. After that, it seemed as if it worked, windows appeared to be normal, but windows security started acting really strange, turning off and on again, sending weird messages for programs which shouldn't be malicious(anvir task manager, gridin anti malware).

And then - I get a ton of notifications from Discord - someone(or some virus) had sent a ton of fake phishing links to everyone on my friends list, and some random people. I deleted the messages and logged out, and I created a Windows Media Creation Tool, so I could start a completely new installation of Windows on a formatted drive.

I formatted both my drives and the partitions, and again it seemed to be normal at first, but last night the same thing with Discord happened, but this time on Instagram - it posted on my account, my story and followed random people. I checked and saw that there was a log in from Helsinki, and I don't know how that's possible since I have two factor authentication turned on.

But my guess is that since I was logged in Instagram on my PC, this hidden virus logged in from my browser and that's why it wasn't detected as a new log in.

Mind you that this happened while I was asleep, and the PC was turned off. I don't know what to do, please if anyone has any idea what I can do, I would love some help.

Windows Security doesn't detect anything, neither does Malwarebytes, Gridin antivirus, or Bitdefender. Would buying new drives and throwing away these help? Or can this thing attach itself on to the BIOS or something like that?

[Moderator Note: Edited post to break up "wall of text" /"wordwall" per comments in the previous posts.]
 
Last edited by a moderator:
Solution
Yes i did, but im 100% sure its from my PC, because thats what happened with discord aswell. And now when i turned my PC on i saw that Reputation-based protection from App and browser control in Windows was turned off. It has to be from my PC

You should uninstall Discord or any programs you installed recently, scan the drives for virus.

Change the credentials for all social networks you've used before reinstalling the apps.

Make sure you download the installers from official source, not from a third-party website.

Tashogeorgiev

Reputable
Dec 7, 2016
22
0
4,510
Maybe your Instagram account has been hacked, in this case those activities can be done without your computer running.

Did you reset the password for your Facebook and Instagram?
Yes i did, but im 100% sure its from my PC, because thats what happened with discord aswell. And now when i turned my PC on i saw that Reputation-based protection from App and browser control in Windows was turned off. It has to be from my PC
 
Yes i did, but im 100% sure its from my PC, because thats what happened with discord aswell. And now when i turned my PC on i saw that Reputation-based protection from App and browser control in Windows was turned off. It has to be from my PC

You should uninstall Discord or any programs you installed recently, scan the drives for virus.

Change the credentials for all social networks you've used before reinstalling the apps.

Make sure you download the installers from official source, not from a third-party website.
 
Solution
D

Deleted member 14196

Guest
This is where you wipe the disc out and do a fresh install of windows and take your back up and restore it. And then be very careful about what you do online and watch your downloading

Even if you find something there’s no guarantee that you will have that it is actually gone

Resetting windows is useless you need to format the drive and install it clean
 
  • Like
Reactions: Unolocogringo
Also windows defender has this option, avast free I think does as well, where you can do a boot time scan where they actually intercept the boot up of windows and scan the drive before windows starts. I’ve seen where stuff was picked up that way.

But from what I read earlier it sounds like the op did do a reinstall with a windows usb drive. May not be a bad idea to create a Ubuntu usb drive or similar and try to do a military style data wipe on your drives where you write zeros to the entire drive. Create a windows 10 usb from a separate pc, then reinstall from usb.
 
D

Deleted member 14196

Guest
op said that they reset windows from within windows. that is not a clean install from USB

he said " I reset it from the settings " that is not a usb install. that is the problem with wordwall posts, most folks don't actually read it. it should be broken into small sentences and paragrahs

the original post is super hard to read--i have to admit I have ignored super long wordwalls just because nobody has the time for that
 
Last edited by a moderator:
You should uninstall Discord or any programs you installed recently, scan the drives for virus.

Change the credentials for all social networks you've used before reinstalling the apps.

Make sure you download the installers from official source, not from a third-party website.
In addition to changing credentials, turn on MFA for anything that you can.
Reboot in safe mode with networking and run full system scans with both Malwarebytes and ESET online scanner (for starters).
 

TRENDING THREADS