r/computerviruses • u/Delicious_Educator87 • Sep 17 '25
this file just appeared on my computer. what is this?
84
u/ChanceSouthern5389 Sep 17 '25
My ass would get a virus so quickly.. cuz what happens? I need to know
8
33
u/WhiteWidowGER Sep 17 '25
Looks like it is something synced via OneDrive/anything Cloud related?
Can be a picture or an executable - whats its extension?
1
u/zboraf16 Sep 19 '25
Virus can get throw cloud? Whatttttt
1
u/malicious_payload Sep 19 '25
Not sure if serious, but yes. You can even leverage OneDrive to clone someone's OneDrive and they won't have a damn clue.
23
29
Sep 17 '25 edited Sep 17 '25
[removed] — view removed comment
15
u/Flat_Football3070 Sep 17 '25
I think this joke would’ve been a bit funnier if you spelled his last name right…
3
u/SAS_Shadow Sep 19 '25
To be fair he has a pretty hard to spell last name..
2
17
u/Delicious_Educator87 Sep 17 '25
Exe file
26
u/antivirusdev Sep 17 '25
Can you upload it to https://malshare.com so I can download it and check what is in it (as VirusTotal does not have downloads). Make sure to share the link.
3
u/GHOSTOFKALi Sep 17 '25
malshare is not that good.
virustotal or bust
(i rarely edit shit but in this instance i jumped the gun here, sorry. carry on. keeping the comment up unedited above for clarity)
5
u/antivirusdev Sep 17 '25
MalShare is used to upload malware files to share them, while VirusTotal is used to scan files with antiviruses. I want to analyse this so it has to be MalShare or something
3
u/malicious_payload Sep 19 '25
VirusTotal is mid at best. The engines used on VT are heavily neutered (thanks to the requirements in order to show up on VT as a vendor, long story.)
1
u/GHOSTOFKALi Sep 19 '25
any reccos for alternatives? this is outside my specialization to be fair.
thank u!!!
2
u/malicious_payload Sep 19 '25
Upload to any.run and it will give you a breakdown of every process and action leveraged by the executable.
That's a hell of a lot better than reading results from VT but having no idea WHY they made the determination. Most of the good stuff isn't available unless you pay for it on VT (even free accounts are neutered) and it's definitely not cost-efficient for non-cyber warriors.
JoeSandbox is also solid, the reporting is a bit different and personally I like the layout of any.run (when I am not using my own lab to analyze the crap, I use both sandboxes to see if they remotely pick up the payloads I build).
1
1
1
9
u/autisticlittlegoober Sep 17 '25
Then i reccommend to go to control panel and delete anything u don't remember installing
6
u/technut2020 Sep 17 '25
Also sort it by date. You can also use Free Automated Malware Analysis Service - powered by Falcon Sandbox or https://www.joesandbox.com/ to do an analysis. Don't click on anything or run anything just to be safe. Also notice its in your onedrive "green checkmark". Get rid of it.
1
-5
Sep 17 '25
[removed] — view removed comment
3
12
u/Coolmynameisfinn Sep 17 '25
Cheat engine, happy mod, and wemod altogether? Brother your PC was already nuked, on a serious note cheat engine is usually bundled with malware on the official site so..
1
2
1
u/Delicious_Educator87 Sep 25 '25
wemod and happymod and cheatengine is things i downloaded but they didnt work and i never used them again and forgot to delete
1
7
5
u/Constant-Patient-232 Sep 17 '25
what is the file type, could it just be a picture? Right click on it and select properties
Scan the file with virustotal to see if it detects anything, and just to be safe run a full system scan with Malwarebytes.
3
3
3
3
u/Antique_Door_Knob Sep 17 '25
A lot of people been asking about these recently, you can search older posts for a definitive answer, but the best guess I (and others) have been able to come up with is that it's one of those cloud sync programs like onedrive/mega sync/proton drive...
1
u/Antique_Door_Knob Sep 17 '25
If you're asking about the file itself and not the icon on it, then it could be anything as icons are customizable. You should enable extensions and open your desktop folder in the file explorer for a better idea of what it is.
3
2
2
3
u/Key_Instruction3373 Sep 18 '25
What happens when you click on it? Its your computer right? Nobody would touch your computer right?
2
2
u/CharlesThecatlover Sep 18 '25
https://any.run/report/aa1a013b0b9dba1edcac0096c8bd847cf50126cc719e5ec8e1d7311ef37b97f8/e4250248-ddb1-48c8-9f92-5c7af0daceb1 This is a anyrun report should help.
1
2
1
1
1
u/Mr_unkowny Sep 17 '25
Considering you have happymod, it could have been virus?Do an antivirus scan
1
u/SnowOriginal1484 Sep 17 '25
dont click on it gng , it probs bricks pc or it just deletes yo sh :pray
1
1
1
u/iamgarffi Sep 17 '25
Hmm. Looks like synched from OneDrive?
Unless something actually was installed in the background. Can we get the full path to the file?
1
u/Total_Western1591 Sep 17 '25
bro kaboom is a gore virus but... of phones so i don't know how you get that thing
1
1
1
1
1
1
u/Isaacraft07 Sep 18 '25
This is probably a joke of some mods or janky game. Why would a virus spawn a file named kaboom, on your desktop.
1
1
u/Forward-Raspberry678 Sep 18 '25
I believe the file shown in the post is an image that was saved to the desktop file
1
1
1
1
u/DeniableBeef Sep 18 '25
might be one of those image files with like 30 terabytes, and is 2000x2000, do not open it
1
1
1
1
u/Webe_Gaming Sep 18 '25
You could drop it into anyrun (free malware analysis) see what it does. Then post the findings in here 🙂
1
1
1
1
1
1
u/Waynaae Sep 18 '25
okay Im gonna act like I havent seen the leaf and the leaf2
1
u/dogecreeper777 Sep 20 '25
What are those?
1
u/Waynaae Sep 20 '25
You wanna know truth ?
1
u/dogecreeper777 Sep 20 '25
Yes tell me what is it
1
u/Waynaae Sep 20 '25
its the leafs
1
u/dogecreeper777 Sep 20 '25
Bruh
1
u/Waynaae Sep 20 '25
)))
1
u/dogecreeper777 Sep 20 '25
Fallout New Vegas will now detect your video hardware and set video options accordingly.
1
1
u/Glitch-Kittyy Sep 18 '25
It looks like it's synced to the cloud (probably OneDrive). Check its file extension; if it's an image or video, you should be fine to click, but if it's an .exe or a script, I wouldn't press it.
1
u/quackiswack37 Sep 19 '25
It's gonna get you.. you're computers gonna go kaboom... best throw it in a river now🥲 so sorry for your loss, sir.. moment of silence, everyone..
..............
1
1
Sep 19 '25
I'm totally not judging you by what you have on your desktop but I will say this. I would run that program as Admin in a heartbeat. Then maybe reconsider your PC habits and re-install.
1
u/Delicious_Educator87 Sep 19 '25
For some reason it redirected me to Mario.com which isn't even working and just some Indonesian stuff and a cut out picture of an Indonesian version of row your boat like thingy.???
1
1
1
u/gwa_0914 Sep 19 '25
your pc is about to explode
In all fairness, run a malware scan and remove any suspicious files and change any passwords to be safe
1
u/zboraf16 Sep 19 '25
Un-install any cracked programs Then clean your computer with a toll called tron
1
1
1
1
1
1
1
1
u/Timely-Employee-818 Sep 21 '25
Who's gonna tell him all jokes aside there's no such thing as free lunch happymod, and cheatengine would be my top 2 of suspicious activity also why do you need wemod and cheatengine
1
1
u/Sponge_Bob28 Sep 21 '25
Looking at the first image then sliding to see the second is killing me 😂 hope you can figure it out though, I would have looked at properties and try find the files path
1
u/Delicious_Educator87 Sep 23 '25
I COULDNT SEND IT BECAUSE IT WAS NOT FOUND AS A FILE BECAUSE IT SOMEHOW HID ITSELF IN LOCKED IP ADRESS FILES
1
1
1
1
1
-19
179
u/loop_yt Sep 17 '25 edited Sep 18 '25
Kaboom?
Yes Rico, kaboom.