Windows 10: Malware / Spyware / Ransomware / virus or system corruption - September 2020

Hi.

About a week ago i intended to briefly turn on "trust network" to check something and almost immediately I got some type of warning from my Mcafee i believe, or at least it appeared to be and then a webpage opened which, from what I saw I think there was some kind of message and.. code beneath it i think, much of it in red. I quickly closed that and tried to turn "don't trust network" back on but seemed to have trouble doing so at first, i kept disconnecting and.. it seemed noticeably slower before I finally managed.


I´m not very computer savvy but I started looking over things and keeping an eye out for changes and as I was doing that and learning more about what I was seeing I think something was claiming more admin privileges and if I´m not mistaken; eroding some of mine. So I started to limit connection time, turning off remote access etc. and downloading Malwarebytes as well which found something but I believe unrelated to whatever problem I may be having . And then I really started to notice things that made me fairly certain I did have some type of malware like: all measures I took would halt for a good long while during the process, scans with MB and Mcafee, and clean/ repair /boot -tips I saw online etc and it seemed to get harder and harder to start my defense programs and certain types of protections were turned off and I couldn't turn them back on again, EVEN in safe mode it seemed.


So finally I did a complete reinstall of windows 10 on an msi stationary btw and even restarted in safe mode right after to be sure and STILL the problem seems to persist. Just before this and after when I went to restart in safe mode I got the message: "If you start up now you and any other people using this PC could lose work" or something close to that and then when I did restart in safe mode it couldn't have been more than a few minutes before my options looked to be narrowing and then everything but the window I had up froze. Just now I started up in safe mode again and when I pressed windows defender I got a message saying: "System detected overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application". Also the last several 5-6 or more -times I booted I got a message on desktop saying: "There is a file or folder on your computer called crogram which could cause certain applications to not function properly. Renaming it to crogram1 would solve this problem."


Now.. like I said I´m not very computer savvy but I think logic can safely assume that this IS malware, and a very sophisticated kind at that. So I have shut down my PC completely and unplugged the power as the state it has been in most of the time the past 3-4 days. I did take a lot of screenshots during all this and pasted most of them in an external hard drive but as I understand it, the drive may be infected too now, and I cannot use my PC obviously so please don't give me an answer to the effect of ´give us more information and paste the report here or... ´download this and that on the PC and try to.. this and that´ And if you DO suggest the latter keep in mind I may not even get to that stage on the PC.


So maybe you can give me some advice and ´educated guesses´ about what it is and how to possibly deal with it?


Please help....




Edit / PS: I thought it might help others who like me don't know much about this kind of thing if they are directed to this post through a search, if I told them something I have learned during this week and maybe save them some time, which is that: There is a thing called "zero-day attacks" you can read about it on wikipedia where basically as I understand it when some new type of malware is created there often is no way for the antivirus software to deal with them YET, and that it may be some time before there even IS a solution available. So if for example someone here or support staff for your anti-malware programs can't help you, then it may be a good solution to turn off, unplug your infected device and then keep an eye out for solutions to new threats. But that's just my someone who doesn't know much assessment so far. Hope someone finds this helpful. :

:)

 

How do you get ahold of anyone at windows defender if you get a Virus or Ransomware Issue

1. For Virus and Malware issues it's best to post either in the Virus and Malware forum:
   Results in Virus and Malware - Microsoft Community or here:
   
   https://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-help/
2. Same applies to Ransomware issues but even better would be this forum:
   Ransomware Help & Tech Support Forum - BleepingComputer.com
   

 

Malware and ransomware protection

You might also want to have a look at:

• https://www.microsoft.com/en-us/wdsi/help
• Top 10 Ways PUPs Sneak Onto Your Computer. And How To Avoid Them.
  
• Ransomware FAQ - Windows Defender Security Intelligence
• Ransomware Avoidance
  
• How to remove ransomware the right way: A step-by-step guide
  

 

Anti-virus and Anti-malware??

Hi Tsw88. While you will see that everyone has their favorite antivirus software, one especially effective step that you can take, in addition to antivirus software, is to make frequent backup images and store them off line so that if you are the victim of ransomware or virus that you will be able to restore your PC from the backup. Many people here use Macrium Reflect either the paid or free version and store the images on a NAS or a USB drive. This will also protect you from bad updates or accidental loss of files. If you don't already do this you really should look into this.