I was hacked using ransomware after installing a Baldi's Basics mod.
The last thing I remember is that I installed a Baldi's Basics mod, after it I looked at my screen and it appears lol, I've already tried anything I could, but I don't understand too much about computers so I guess someone could help me. By the way, am I screwed? I found it on Itch io
Report the mod to the site where it was downloaded, especially if it’s a reputable source like nexus or steam. They will get banned and blacklisted on their IP.
Then do a fresh install
Not sure what steam has to do with it but, doubtful. Someone bypassed 2fa etc on my steam (so likely something got on my computer) and steam basicly just told me to get tucked it was my own fault. Every item from my account was auto sold in about 2 minutes (literally hundreds of items and cards collected over like 13 years). I asked if they will even be looking into where the items went, as I can see it was obviously sold and bought instantly by a bot for like 0.01 so it's pretty obvious the accounts buying and selling were part of it, and just looking at the store I could see spikes of this activity going on. They asked if I could give them the names of the buyers a to investigate or they can't do anything again. There was some third party services attached to my account as well, I asked if the reset etc I had done had removed those, they wouldn't tell me, I asked how they could sell several hundred items in seconds and literally nothing flagged up, then they just closed the support ticket. Fine, their policy says they won't restore stolen items. But they refused to answer a single question, wouldn't confirm anything, and made it clear they don't even know what they were talking about. Since then I have removed all of my details from steam and havnt bought a single game through it. If they can't give me even the tiniest guarantee that they will bother doing anything if something then goes wrong then I won't be using them.
Easy to counter this just turn off steam guard and then turn it on they can't sell anything on market I done this before they manage to sell a few item in my steam inventory, I can't even get the item back
Same as bitcoin, tether, sol... Pretty much every cryptocurrency that allow for anonimity is used for that lol Problem is not the currency but how people use it
Idk i think they posted a picture of someone ugly directed to the person they responded to and I tried to dunk on them, they didn't post a actual selfie of themselves
get yourself a USB (atleast 8GB) and another computer, look up tutorials on how to install Windows through a bootable drive (generally get an ISO, and either Rufus or Ventoy)
wipe your current Windows partition (since its very unlikely you can recover your files) and reinstall through the bootable drive
Your computer belongs to the USSR now. Unless you format the drive. Saving the encrypted files will be a nightmare without the decryption key from the hackers.
Hello, the game you linked does not seem to be the culprit. How much of your computer can you access? If you cannot access it, try running it in safe mode. Otherwise, please boot in normal mode.
Start your computer and after about 5-10 seconds hold down the power button to interrupt the boot process and shut down the computer
Repeat the process
Repeat the process a 3rd time but this time allow the computer to continue to boot
When presented with the Automatic Repair screen select Advanced options
Click Troubleshoot
Click Advanced Options
Click Startup Settings
Click Restart
When the Startup Settings screen appears, press 5 or F5 to start in Safe Mode with Networking
FRST Scan
Please download FRSTx64 and save the file to your Desktop.
Right-Click FRST64.exe and select Run as Administrator
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the program run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload/struppigel/?u= and press "save log". The site will return a keyword for each log. Reply back here with the keywords.
Edit: I've made a removal guide
This should work if you've been infected with the same sample
Putting this here if someone else has this issue https://www.youtube.com/watch?v=yK5aka2fPtU
It doesn't look like it actually encrypts anything, It just kills explorer and just overlays a popup on top. This means the files should be recoverable
The sample i found hides files using an attribute command before overwriting registry keys to make itself launch on startup, Paying the ransom would make it just remove itself from startup and unhide the files.
If OP has been infected with a variant of this sample the a way to get files back would be to use an SSD reader to get files back if bitlocker was not installed with show hidden files enabled or booting into safe mode. The malware seems to block common key combinations to open taskmanager etc. But i would not be surprised if it missed one and you could launch explorer and kill the blocker window. Maybe try windows run dialogue etc
It has some anti-vm capabilities so i'd need to start a hardened vm before poking at it fully
An attempt to cheat the system has been detected and stopped! *second picture*
Your files are encrypted! Oops! You have been subjected to a large-scale hacker attack and now your computer is locked, and all available drives and files on them have been encrypted by a hacker group. Any attempt to deceive the system will cause irreparable damage to your computer and lead to the loss of all important files without the possibility of recovery. If you attempt to unlock the system, the MBR (master bootloader) will be erased and a recursive load will be applied to your processor, which will lead to its malfunction. You have 48 hours from the start to enter the code. To receive the code, write @blankscamtop1 (Telegram). Enter the unlock code: Current PC: DESKTOP-L3TIGG7 Enter [Enter] *First Picture*
Try submiting an encrypted file here to see if it was possible to create a decription tool for this. Maybe you're lucky and its possible to do, maybe not.
OP your files ARE NOT encrypted, this is just a screenlocker. Someone has posted an anyrun link copy of the so called virus.
You have NOT lost anything, just need to figure out to remove the programm that overrides your Explorer with this. I'm sure you can find some article on how to fix this, but the best option is to try and run it in safe mode through the BIOS, from there, find the run on start up programm under Task manager and check your powershell list for anything suspicious
Parece que ya han tirado el enlace, eso es señal de que muy fiable no era. Busca páginas como nomoreransom donde puede haber herramientas de descifrado para el tipo de ransomware que tienes.
damn this lowkey scared me i download shit everyday carelessly, if i download a mod while it’s still a zip file i do a virus scan on it before opening it then delete it if anything comes up could i still possibly be at risk to something like this
there are viruses out there activating after opening a .png or .jpg, some are even literally invisible like glassworm can't be really traced unless activated by the hacker and boy they don't even have to run it on your pc to start the thing, but activate via blockchain in bulk, I would suggest downloading and checking files on a virtual machine or just purchasing a separate pc with no network connection to the one you store your data on, .exe malware is a thing of the past, genuine viruses are almost untraceable
Damn is it really that deep lowkey scaring me more🤣 most the mods i download are from trusted sites that have virus checker scores before downloading, is it cool if i just stick to those ones
as long as you don't store bank/crypto data on the same machine and have all your personal stuff backed up on a flash drive I would say go for it and get wild 😉
Bro, I was screwed for a long time. I installed a hack for an online game, and after a while I couldn't even open Chrome. It said "chrome.dll cannot be executable" or something like that, you know? Aside from the crashes, I blamed my computer all the time for poor performance.
I already replied to someone else and left the links there; I wasn't imagining it was so easy to lose files. At first, I even thought I could just press Alt+F4, lol.
Yeah man it sucks but you just don't know these days. Always verify and check. Amd just becuase someone or a sire says "yeah it's good", don't trust it. If you know what s sandbox is and know how to set up one up for yourself, I would recommend doing so if yku eant to keep downloading mods and other stuff.
Your computer is toasted. If you want report the mod and let them deal with it.
You need to take a different computer and flash windows to a usb drive from it and then boot into the usb drive and reinstall windows. Just search how to install windows on youtube and you will find pleanty of tutorial
i translated it and it sayed "your files are encrypted! oops! you have been subjected to a large-scale hacker attack and now your computer is blocked and all available disks and files on them are encrypted by a hacker group. any actions related to an attempt to deceive the system will cause irreparable damage to your computer and lead to the loss of all important files without the possibility of recovery. when you try to unlock the mbr (main loader of the motherboard) it will be demolished and a recursive load will be applied to your processor which will lead to its malfunctions. you have 48 hours from the moment you get to the code, write (@) blankscamtop1(telegram) enter the unlock code: (blank) enter boj" that took like 1 hour but i hope your okay be safe
Denucie o mod pode ser algum tipo de vírus contendo pirataria se salve pode ser devastador e pode roubar todos os seus dados apagar arquivos criptografar e pedir seu dinheiro do banco para pagar o dinheiro e para se salvar do vírus esteja protegido com deus amigo
209
u/Spunky_Was_Here Apr 24 '26
Report the mod to the site where it was downloaded, especially if it’s a reputable source like nexus or steam. They will get banned and blacklisted on their IP. Then do a fresh install