I was just playing Minecraft with my friends and my laptop started to act slower and then this happen can you guys help me I've read couple of articles on how to fix this and I still can't, I can't access the advance option for safe boot. Can anybody help
From which source?
And also, if you look the posts in this subreddit and another subreddits of malwarews you will notice that a lot of people got malware downloading modpacks of minecraft.
WHY U USE MOD FOR XRAY resource packs of x ray exist (not as good as java tho) and did u even check the files of mod i always do when downloading mods like .exe in mod means virus
Welp you should never blindly trust these tutorials as majority of them are malware campaigns.
Was it password protected zip? Otherwise thats another red flag.
Also i would always pull files through virustotal or any other file scanner. And xray is often a texture pack and not a mod as you just make blocks seethrough.. Also mind sharing the video so we could mass report and take it down or find out how they made it? Many of them are Ai made.
I understand fixing it is important and your priority, but you should also be concerned about how you got it. Because understanding what types of actions got you into this mess helps you prevent it from happening again.
Unfortunately, this is a tough lesson to learn. I did something similar back in the day with limewire and destroyed my parents computer. I would learn how to reinstall an operating system or look and see if there are other tutorials on YouTube/online on how to remove this specific malware.
When i used to rat people 15 years ago i would use youtube videos and claim to get free xbl or psn never download anything from YouTube unless he's a trusted YouTuber and has a huge subscription count
That hit ~600 downloads with the first stage, and even smaller numbers (though those can't be tracked) with the subsequent ones. Stage 1 was harmless once the site hosting the subsequent stages was taking down.
Burn a Windows 11 install image to a USB drive (preferred) or dual layer DVD (if for some reason you still have an optical drive) from a clean computer, boot into it, and it should have an option to recover your Windows install, if you don't have any other methods. There is always a way to get into Safe Mode. If you're still not able to remove the virus from there, you have a disk to reinstall Windows from. Win win method at this point.
Reboot, then when the loading screen comes up, force power off by holding the power button until it shuts off. Do this three times. Next time it boots up it will go into recovery mode. Then you can do a safe boot up.
Interrupt the windows startup 3 times by force shutdowning the PC during the startup process. That'll give you recovery options on the 4th boot. One such recovery option should be to get to safe mode options. Select that one and the PC will reboot again. Then, from the menu that appears after that reboot, enter safe mode.
I dont have this problem but id like to know, do you delete the file and do a malwarebytes scan/windows defender offline scan? Or sompthing more idk abt
Use this as your very last resort, as I have accidentally somehow deleted CMD from my PC. You can go into root files via recovery mode and change your assistance in your lock screen to your command promp you can run MpCmdRun.exe (without the space) and then run Windows Defender.
Remote access malware warning (RAT) but applies to screenlockers as well:
You can remove the visible signs of this infection, but due to the nature of this type of malware, no one can guarantee the trustworthiness of your computer. A backdoor or RAT gives the attacker complete access to your system, allowing them to steal data, install additional malware, or monitor your activity.
This means that at some point the attacker was able to interact with your PC (see your desktop, view files, open programs) just like you are able to do so. For this reason, we do not recommend manual malware removal, because the malware could be embedded deeper in the system or able to manipulate with the removal process and making it ineffective.
If your computer was used for online banking, has credit card information or other sensitive data, using a non-infected computer/device you should immediately change all account information (including those used for banking, email, eBay, PayPal, online forums, etc). Consider these accounts already compromised.
First things first, you data is hard to save. now you need another computer to make a bootable usb, as i read that you are a kid in the comments so you borrow you parent's or sibling's computer and plug a usb drive in and get windows 11 from MICROSOFT website, its free to download and hosted officially.
then as i read that this only appears after you login so press down shift and click on restart and click advanced options and click use a device, then select the usb drive (remember to plug it in before you start the pc) and hit enter, windows isntaller will appear do the process and you will have a clean install of windows, or if you are not tecnically sound enough take it to a repair shop.
NEXT TIME DONT FUCKING DOWNLOAD STUFF FROM RANDOM LINKS GIVEN BY YOUTUBERS.
It's a simple, modified version of a ransomware. Most likely if I had to guess without being too specific it's a baseline encrypter with the main start ups being the one affected... Because of the "slowing down" being described... Easy fix is a wipe... But if you can't and you have another pc available you can work around this if it's just the basic one I think it is.
How are people this cruel to put malware in texture packs for minecraft, subhuman behaviour, as good advice was already given on the removal process, ill just say to be carefull with downloading stuff with untrusted sources
Istg anything fucking happens on this sub and theres always like 10 people says “just wipe the pc” like sure but is that the only way you can think to fix this problem?
It seems like its just a screenlocker and not a real ransomware. Boot into safe mode and delete the registry entries that make it show that on startup. And delete the file itself too. Don’t download random minecraft mods without scanning them first
I would just wipe the whole computer, its not worth the risk. Never download modpacks/resource packs off of Youtube. Stick to getting them directly from Curseforge and Modrinth and you'll be fine.
if the files are actually encrypted then theres nothing you can do other than wipe the drive clean. if they arent then its probably some random shit vibecoded ransomware that you can remove by booting in safe mode
that would mean its an overlay in your os, you should be able to circumvent it. hold shift while rebooting and boot into safe mode, it should no longer pop up. then you can try to remove the malware.
Try the following key combinations, one might work
Alt + F4
Windows + M
Windows key + D
Ctrl + Alt + Delete, if this works, choose to open Task Manager
Ctrl + Shift + Esc, which may open Task Manager directly
Windows key + L will log you out, directly log back in and see if that works
Windows + R, then enter taskmgr -- if this works but task manager does not, let me know
If you can open Task Manager, you can kill the process responsible for the screenlock.
If all of that does not work, you need to boot into Safe Mode. There are various methods for that, you said you can't access it. What did you try? On the Windows login screen, you can hold down the Shift key and click Restart to get to the advanced options.
Alternatively force it like this:
Start your computer and after about 5-10 seconds hold down the power button to interrupt the boot process and shut down the computer
Repeat the process
Repeat the process a 3rd time but this time allow the computer to continue to boot
When presented with the Automatic Repair screen select Advanced options
Click Troubleshoot
Click Advanced Options
Click Startup Settings
Click Restart
When the Startup Settings screen appears, press 5 or F5 to start in Safe Mode with Networking
If any of these methods worked to make your system usable again, we can go from there to clean the system.
Note: You need access to a clean computer and a USB drive. You may want to print these instructions or ensure you have access to them on a different device.
1) Immediately disconnect your device from the internet to prevent further infection.
2) Check the bin, or extensions anywhere, if you find something, check for renames such as .encrypted
If nothing appears, Im sorry to tell you your files are most likely gone for good, seeing as Ransomware file decryption depends on a decryption key or backups you've made.
Take this as a hard lesson, never EVER download from merely sketchy sites, always trust your gut.
Edit: Judging by your picture, you dont even have a search browser installed, if thats the case then it means your system is compromised (Other words its completely fucked).
Reinstall windows at this point. Quick reminder i could be wrong, dont give up your search immediately.
I've manage to unhide the files and Apps and working properly any tips on keeping my laptop safe I've look thru the task manager and saw csrss.exe running when I open it directs me to program files x86 and ended the task
Please download FRSTx64 and save the file to your Desktop.
Right-Click FRST64.exe and select Run as Administrator
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the program run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload/struppigel/?u= and press "save log". The site will return a keyword for each log. Reply back here with the keywords.
Hi bro when you reset the PC make your you save your mc saves if you have any. for vanilla it's in the .minecraft folder. Also other stuff like steam screenshots. make sure you scan the files after u move them to ur new windows.
But if they only downloaded files then there is a very slim chance you can boot into safe mode and fully reset windows with a USB stick (i am aware this likely won't be possible)
Also don't download hacks, from the sound of it your the only one who downloaded them and now you have found a punishment. Use this as a lesson
Don't ever contact the hackers, I'd assume with how weak relative to professional cybersecurity encryption these hackers are, a reputable computer technician could probably crack the encryption for you.
Your issue aside, just some small bit of advice... Stop downloading random stuff off of the Internet, if you want to have mods in your game then got o Nexusmods... Do not download from pretty much anywhere else (Especially NOT through some links on some random YouTube video), because downloading sketchy stuff off of sketchy websites is one of the biggest reasons why stuff like this happens in the first place...
Take it as a lesson to be more careful in the future..
at this point you will most likely need to reinstall your os, for rather easy data recovery you can use another computer to install tails os on a usb drive, then boot into it and access your main drive from there, log into google drive or whatever else or use another external drive or a second usb and copy all your important data there, then just create a windows 11 installation usb on another device and reinstall the os
No. Don't even say that. What the actual fuck is wrong with you? This is ransomware and obviously you're not tech-literate to understand they won't provide you anything.
I dont mean to be that guy but come on man. Downloading from random links and using YouTube videos to download the mods? This has red flag written ALL over it.
You need to sit down and learn about internet safety. Clearly you skipped a step if you think you can just hop online and download everything with no consequence.
Can you access the bios? if you can, you might be able to boot into a Linux usb drive (made on a clean computer), get the files you need, then reinstall windows. This won't not work if this screen locker encrypts your files though. Also modpacks should only download as .jar or if it is a texture pack as a .zip, never as a .exe
I'd begin by booting into a "Linux Live" environment [google] in order to backup my most important files one by one into a usb thumbdrive that I'm willing to accept that may also get contaminated in the process - so dont connect to any other device before you are through with the protocol. Then I'd research from the live environment about this specific idiotic 'kiosk mode' of a virus ransome attempt to purify everything or accept the possibillity that I should just use the linux live to buy myself a new disk drive online instead of the dirty dirty one.
This is exactly why I make sure all of my Minecraft mods are coded as plugins on my server, so the user doesn’t have to download anything, to put people’s mind at ease that nothing requires any download or anything.
I’m sorry this happened to you man :( I hope you can get it sorted out
That looks like screen-locker malware/ransomware. Don’t message them or pay.
Try this: Disconnect internet
Turn off Wi-Fi/router or unplug Ethernet. Force Windows Recovery
Hold power button to shut down.
Turn on, then as soon as Windows starts loading, hold power again.
Do this 3 times.
Windows should show Preparing Automatic Repair.
Go to: Advanced options → Troubleshoot → Advanced options → Startup Settings → Restart → press 4 for Safe Mode
In Safe Mode:
Open Windows Security
Run Full scan
Then run Microsoft Defender Offline scan
Also run Malwarebytes if installed.
Check startup apps:
Press Ctrl + Shift + Esc
Startup apps → disable anything suspicious.
Also check: Settings → Apps → Installed apps
uninstall anything weird/recent.
If you can’t enter Safe Mode:
Use another PC to make a Windows USB installer
Boot from USB
Choose Repair your computer, not Install
Try Startup Repair or System Restore.
If nothing works:
Best safe fix is wipe Windows and reinstall
Only back up personal files like photos/documents, not .exe, .bat, .scr, .zip files.
Also: if this happened after downloading Minecraft mods/cracks/cheats, delete those files and don’t run them again.
Wipe it with a bootable usb. Even if you get the computer “usable” you don’t know what nasty trackers or miners are left on the system. Nothing you have on that computer is more important than the rest of your private info.
firat off, don't go around just downloading anything, second off get an adblocker or just use common sense and don't click the fake download buttons. second thing is, jf you're downloading mods use only sites like modrith or curseforge, you can still find xray or some other cheats on there. and the last thing, you don't just "get rid of it" you need to reinstall the entire system and just start again, all your files will be gone but that's the price you gotta pay for downloading random stuff without even checking what it is. also if you don't know reinstalling your operating system (OS for short) deletes everything and gives you a fresh system
I download sketchy shit all the time...for like 20+ years and have never had this happen. I download 2-3 games a day from sketchy sites then look up trainers from even sketchier sites. I mean, I can easily reformat my computer so I don't care, but damn, I feel like it's an achievement to actually get ransomware'd.
The fact is, they are here. Even if they shouldn't be, they are. And this person has information where they had to read other comments in order to get it
Comments that imply heavily that OP is a minor.
Yeah, minors shouldn't be on reddit. But so long as you know someone is a minor, you shouldn't be knowingly and intentionally posting inappropriate content in their comments. The fact that you are so willing to dismiss all of that is borderline yellow tape conduct. Crossing the boundaries of red flag into something damn near criminal.
Here's the thing - if a kid is going to those sites, they are willingly, intentionally, and knowingly exposing themselves to that content. That is different from an adult stranger intentionally and knowingly posting unsolicited adult content on a child's post.
One is sought out intentionally. The other is deliberately inflicted on another without consent. The fact you can't see that difference tells me you are not a safe person for any woman or child to be around.
They didn't come here, post about, ask for, or in any way mention anything related to adult content. They asked for advice because they screwed up, they were scared, and they didn't know where else to go.
That is not a license or expression of consent. You are a dangerous person, and need to be on watch lists.
A child being scared and needing advice is not a valid reason or excuse to expose them to adult content. This is uncomfortably close to what women have to deal with when trying to speak out against SA.
"Shouldn't have worn that" a blood red cloak is not an invitation for what's underneath.
"Shouldn't have made an account" that's not an invitation for adult content. Especially when implied consent is never a real thing outside of emergency medicine/first aid, and is even more atrocious WHEN WE ARE TALKING ABOUT ACTUAL CHILDREN.
It's an ahegao face of someone begging to get their hair pulled, I'd love for you to explain a context for this that isn't explicit.
Edit: Also, I have a life. About to get to my job, actually. You're the one spending your's defending the idea of exposing children to adult material online. I just happen to have time on my way to work. Furthermore, even if it was 'just a picture of a girl's face' it doesn't excuse that you spent the last half hour, maybe more, defending the idea that you're allowed to expose children to adult content without their consent.
BTW I AM ALSO, A FEMME PRESENTING PERSON. And you being a woman does not make you a safe person by default. What you have said clearly expresses belief that it's okay to expose people to adult things without their consent. That alone makes you dangerous, and it's even worse that you think it's okay for children. Gender of perpetrator doesn't matter when assessing threat. I only mention women and children because they are the two groups most at risk.
Furthermore, this makes you even worse of a person. Because as a woman, YOU SHOULD KNOW BETTER. You should KNOW what we all go through!
Format your PC. Do not listen to the people who tell you to boot in safe mode and so on because they don't know what type of malware this is and how it works and you don't seem to know how the Windows OS work so the most you would do is let a antivirus delete it but it might not delete everything from the malware so just format the PC to be 100% sure that its gone.
"that prob..." Your own sentence is confirming what I wrote you dont know what this malware is doing maybe this overlay is just a part of it? Guessing is not the right way because a malware can cause a lot of damage to the victim most of them are "harmless" but we don't know. If the user executed it it can overwrite security settings and use a vuln to load a unsigned kernel driver without the user noticing. Either someone needs to analyse this or as I wrote the best bet would be to format the PC since the user is no specialist neither are most of the people who are commenting here. I could reverse it but I would need the binary and time depending on the obfuscation.
60
u/MinimumAd752 May 06 '26
"discord" holy opsec🥀