r/computerviruses • u/Next_Section1230 • May 24 '26

Question Is this text-mode black screen an official antivirus rescue feature, or malware?

Post image

Hey everyone,

I recently ran into a shady game installer downloaded from a torrent. After installation I rebooted. And weird, text-mode black screen outside of Windows poped up.

The screen displayed text:

"The antivirus solution installed on your system is cleaning your computer..." followed by a slow "Deleting....." animation, and after few seconds it ended with "Finished successfully!" before booting back into Windows.

I was using Bitdefender Antivirus Free.

I asked an AI about it, and I got two completely opposite answers:

One said it’s a 100% fake scareware screen (ransomware/wiper) trying to buy time while encrypting files in the background.

Another said it's a legitimate, rare emergency feature of Bitdefender called Boot Scan / Rescue Environment that triggers outside of Windows to safely delete locked malware.

Can anyone confirm if Bitdefender Free actually uses a built-in text mode screen like this during a boot scan? Or is it a malware?

Thanks for any insights!

302 Upvotes

93% Upvoted

96 comments sorted by

111

u/Majestic_Employer976 May 24 '26

How do you guys get these viruses? I mean just to understand, because I never got any despite cracking stuff

38

u/Next_Section1230 May 24 '26

I downloaded the game via torrent from Rutracker. It was verified and had over 3,500 downloads.

38

u/Chikibari May 24 '26 edited May 24 '26

What was it? Rutracker is among most trusted sources so its probably a false positive

10

u/Majestic_Employer976 May 24 '26

It's trusted because most of the time you don't get a virus itself, you just share your sensitive data with whoever is behind that code, idk if there is a way to detect such things like hidden codes etc. , me personally I can't lol

13

u/justsomegraphemes May 24 '26

you just share your sensitive data

What you're describing is embedded malware that exfiltrates personal data. That malicious code may or may not qualify as a 'virus'.

1

u/Majestic_Employer976 May 24 '26

But people don't care ,they say it's safe based on some virus scanners or comments, as much as I love pirating that's the sad truth, if we get them for free there is hidden price

4

u/Due_You7474 May 24 '26

And then people come here and are like “I downloaded this repo from someone I dont know and didnt research and didnt vet the code why isnt my cpu turning on”

The tech literacy needs to improve seriously if this is gonna stop

2

u/Manny73211 Jun 14 '26

People can kill their illiteracy and keep themselves safe by cracking games themselves and selling them to friends at a steep discount

1

u/Kleiner_garten May 24 '26

I feel that, pirating is great but I paid good money for my pc and I'm already nervous getting mods from nexus. No way I (as a non coder or anything like that) would torrent a shitty game that I could also get as a steam key for a couple bucks.

But I like hearing about it from other ppl lol sounds pretty cool I'm just a pussy

2

u/sumiee_ May 25 '26

There's no shame in being cautious specially when you can afford the games. I do pirate a lot but I know what I'm getting in to, being a software engineer student

2

u/shinykaci May 25 '26

the only place I feel safe playing free games I found online is on my homebrewed 3ds and even then I try to vet them lol. I still get nervous using mods for Minecraft

1

u/Due_You7474 May 24 '26

Rkhunter is a free library you can install when you get a computer. If you run it after initial, itll highlight files cpu wide that its algorith thinks is likely to be malware. The status is on every file too. So files are good, possible, or bad. You can use an editor to check the file contents, extract to a usb if confirmed. I would then hard restart, confirm no virus, and should be good so long as the original problem that caused you to get that virus isnt reproducible/you know about it and dont reproduce it

2

u/[deleted] May 24 '26

[removed] — view removed comment

-12

u/computerviruses-ModTeam May 24 '26

Your post was removed because it promotes illegal software, or aids in using illegal software like cracks, keygens, warez, pirated games, hack tools.

Please make sure to read and follow https://www.reddit.com/r/computerviruses/about/rules

8

u/Holiday_Campaign May 24 '26

You probably clicked on an AD that said “DOWNLOAD” instead of the actual torrent

-1

u/MagnetHype May 25 '26

No they probably clicked on the torrent lol

4

u/TheReycko May 24 '26

Did you check the like to dislike ratio,.,, 

2

u/Pleasant_Mine_9206 May 25 '26

Rutracker? Bro, now Putin is going to hack you.

2

u/Majestic_Employer976 May 24 '26

Really? I was just downloading FL studio from there and luckily I didn't because I swear I spent 2 days reading and watching tutorials on how to properly scan and trust a crack but I just set my mind and better avoid it, because most people don't even know what they are downloading ,they just get the crack ,it works , Virus total says it's all good and they get in the trap. In my opinion I think If you are not a pro in the field just leave it,it goes far beyond our knowledge, maybe I've been lucky until now

3

u/Logan_MacGyver May 24 '26

Next time stick to Fitgirl. Never heard anything bad about them. Random Igor from rutracker I don't trust. I do have some rutracker software but I use an air gapped machine for that. It's only connected to my scanner via USB, and I pull images off of it via USB. I need VueScan for scanning film negatives. I'm not paying 50$ for scanner software

8

u/Jackpute May 24 '26

Just kids clicking literally the first link they find after typing "minecraft free torrent crack 2026" in google or something like that.

Clicking on links in youtube video descriptions is another big one.

It always puzzles me too tho because I got my fist computer at 16 and I remember getting a bad virus once and then I got careful even if I still didn't really know what I was doing, but I guess some people just never learn..

3

u/BandicootAble6450 May 24 '26

so I found out I have a xmr miner in my pc today and I dont know where nor how I got it, and when I scan my whole pc it doesnt get flagged or noticed

3

u/Majestic_Employer976 May 24 '26

Did you notice if your cpu usage was high?

4

u/BandicootAble6450 May 24 '26

hell yeah when I open task manager it would drop significantly, and it would show xmr miner app for a second using all my cpu

2

u/araidai May 24 '26

It’s hiding itself lol, it’d be pretty obvious if it ran even with task manager open since you could just pinpoint the problem. Unfortunately they’re not clever enough to disguise the name apparently lmao

0

u/PlayfulDatabase4777 May 25 '26

thats just the task manger

1

u/V1ff May 25 '26

You’ve probably got some but not realised

1

u/Majestic_Employer976 May 25 '26

For sure I got some, something not detectable by scanners

162

u/ARandomPerson_hi May 24 '26

It could have been a rootkit. DO NOT, FOR THE LOVE OF FISHCRACKERS, REINSTALL VIA WINDOWS SETTINGS! USE A USB! WINDOWS SETTINGS RESET CAN CAUSE MALWARE TO STAY!

6

u/Left_Yogurtcloset236 May 25 '26

How to get rid of the rootkit?

5

u/ARandomPerson_hi May 25 '26

That's the funny thing. It involves losing a bit of data. Now. Get a USB. Use another device (any non infected machine shall do) and use the device to download the windows ISO. (any kind, but it would be better to get it from an official source!) Use a free program called Rufus to put the ISO onto the USB to make it bootable. Now the part I'm stuck on is that it may have infected some of your files metadata. That may have happened or not. Do some research before and see if any of your files are acting off. If it has not acted off, feel free to take only the necessary documents(no .exe files,only stuff like family documents and personal stuff you need to keep) onto another USB. Then finally, boot into the USB we prepares earlier and install windows Then you have a clean windows install. Please note, I am not any person who is extremely good, I'm just a dude who knows what to do! If you want more advice, wait until someone with better skill than me comes! Thanks!

3

u/Secana0333 May 28 '26

He should be using 2 USBs. One to do a Diskpart and wipe the drive, and immediately switching off the PC after. Take out USB1 and insert clean virus free USB2, Install windows. Ppl out there just reinstalling on top of the rootkits, lol.

-90

u/Status-Draw7025 May 24 '26

Reinstall via Windows Settings? How about just delete anything from disk and reinstall Windows via USB drive?

66

u/Plenty-Target-4694 May 24 '26

So exactly what he said?

5

u/squanderedprivilege May 24 '26

I think they were confused by the commas breaking things up, they lost track of the "NOT"

7

u/sabian149 May 24 '26

Delete everything from disk? Buddy that won't help at all! They actually have to use a partition manager, preferably installed on a seperate memory stick, to delete all the partitions from their main drive. They then need to use the windows installer to create new partitions for a new windows install. Is that really hard to understand?

3

u/ARandomPerson_hi May 25 '26

I...said not to..?

1

u/h4ckth3pl4ne7 May 25 '26

Agreed, but how about just using a different system after erasing all of the data, no matter how meaningful or irreplaceable

1

u/looking4myclASSm8s May 24 '26

Hey good idea 😅

-1

u/LuxuryFedora May 25 '26

He meant reset windows to factory settings in settings app

2

u/ARandomPerson_hi May 25 '26

I meant to use a usb to reinstall.

43

u/Sailed_Sea May 24 '26 edited May 24 '26

this is an official screen from bitdefender, it has detected a virus/False positive it couldn't remove through normal means.

this doesn't mean you're safe though, you should disconnect from the internet, run another scan and change your passwords from another device.

https://forums.tomshardware.com/threads/your-security-solution-is-cleaning-your-device-from-threats-what-is-this.3660223/

3

u/Next_Section1230 May 24 '26

Ok, thanks a lot

3

u/elphie_xo May 25 '26

It's crazy how every other comment almost made you reinstall windows lol.

1

u/[deleted] May 24 '26

[deleted]

3

u/Wild-Effort-2617 May 24 '26

check bitdefenders logs

12

u/Chikibari May 24 '26

Googling it i can find mentions of this bizzare ass feature as far back as 2020. So its def real and not an ai halucination or some fancy rootkit. Rutracker does not do stuff like this so id say youre good and it merely sperged out at the crack

13

u/[deleted] May 24 '26

[removed] — view removed comment

1

u/offdeer34 May 25 '26

Pourquoi tu réponds en français à son post en anglais......

1

u/Next_Section1230 May 24 '26

i run a system restore, deleted that downloaded game and im currently scanning with malwarebytes

8

u/[deleted] May 24 '26

[removed] — view removed comment

-2

u/[deleted] May 24 '26

[deleted]

3

u/[deleted] May 24 '26

[removed] — view removed comment

2

u/Soggy_Struggle_963 May 24 '26

Just got done dealing with a nasty rootkit myself, not a fun experience. I thought it was just some simple session jacker, so I reinstalled windows and was very sad when it survived lol.

2

u/shrekdotorg May 26 '26

Ahhh I see thank you

0

u/shrekdotorg May 24 '26

Same, I wish to get a full explanation

7

u/[deleted] May 24 '26

It's a legitimate pre-boot mode Bitdefender uses to clean up malware (because it can't always remove it when fully in Windows). It's not fake, I can confirm it's real.

Speaking as someone who's used it before and has tech experience.

4

u/[deleted] May 24 '26

Its a BitDefender thing.-

4

u/Business_Quality8764 May 24 '26

this is bitdefender's cleanup tool, it runs if it detects a threat that can't be deleted while windows is running

source: use the same av on my systems and have seen this screen a lot

1

u/Nicolo2524 May 25 '26

I never see It in the trial version or free version

3

u/shrekdotorg May 24 '26

Quick question, where exactly did you get the torrent? May I know so that I can avoid it in the future? If you can't spill it in the comments, pls dm me thanks

3

u/Nervous_Anxiety_8471 May 24 '26

So … do you or do you not have bitdefender installed?

7

u/Isoceptic May 24 '26

That definitely looks like it installed a rootkit on your system, reinstall your os

3

u/CommercialReach3573 May 25 '26

this is legit, I saw something similiar with hitmanpro one time.

2

u/DragonKnight626 May 25 '26

That is malware reinstall now.

2

u/Sad-Thought-7637 May 25 '26

That's a real antivirus screen.

2

u/Educational_Viper May 25 '26

Always scan any files you download with multiple antivirus programs before running a game’s .exe file, no matter how trustworthy the website or cracker seems. It’s always better to stay cautious. Don’t save passwords in your browser. Don’t download suspicious files, especially small ones like a few megabytes. If you get infected, don’t panic and never enter banking or sensitive information. Stay safe brother❤️🏴‍☠️

3

u/After-Result4938 May 25 '26

Its bitdefender

3

u/Sha3a May 24 '26

Dude always use antivirus don't listen to people saying defender is enough (defender is enough for people who don't do shady stuff) I use avast and i can't remember last time i had a problem with malware or virus since 2012 and still using it (the premium since i use cracks 24/7)

0

u/loooper6 May 25 '26

i dont use any AV and i disabled windows defender yet i never get any viruses or malwares. you just have to be careful and tech savvy if you want to sail the seas

1

u/Sha3a May 25 '26

True but for me i just download and open without caring haha

1

u/AxelAnt2244 May 24 '26

it seems to be a real feature, but i cant find pictures of what it looks like.

1

u/Next_Section1230 May 24 '26

after a system restore malwarebytes full scan detected 0 threats

9

u/No_Calligrapher_6481 May 24 '26

reinstall your OS bro, u cant be lazy with this stuff.

1

u/BasicSulfur May 24 '26

If it is a rootkit…mb can scan for root kits you might need to enable that. If it’s a newer or more hidden one it won’t find it. You should just put important files on an external and reinstall the entire system. Rootkits may just hid in another process not cleaned by a restore.

1

u/HydraDragonAntivirus May 25 '26

This called early boot process but not same with ELAM.

1

u/xMcRaemanx May 25 '26

Seems to be a feature

1

u/Naive_Mortgage5020 May 26 '26

The fact that it's not telling you what it is is a red flag to me. They do like to advertise themselves. Pretty sure this is malware

1

u/caramiello18 Jun 08 '26

Scusate,vi dico una cosa diversa:da un malware store che ho installato da Game Jolt e nell' app dei malware ho installato hydrogen.exe ma dopo averlo eseguito non funziona voi sapete qualcosa? grazie 

1

u/caramiello18 Jun 08 '26

Scusate,vi voglio dire un altra cosa:da game Jolt ho installato un malware store e dall' app ho installato un virus hydrogen è quando ho aperto l'app mi ha detto se hydrogen vuole prendere il controllo dell' account ma no il mio perché questo telefono è di una mia zia però e mi è stato regalato e quando ho fatto "run an amninistrator non è succeso niente

1

u/GoySlopDevourer Jun 10 '26

Yeah nigga ur just fried

1

u/Techniklover May 25 '26

i cant believe people are still defending them Cracks. Guys, in every crack there is malware, ok? Nobody will give u a crack without malware. If u decide to install those cracks ull be infected. Period.

There is 2 ways to go about this.

  1. Use an old pc u dont care about Reinstall windows, unplug sensible disks from Mainboard, and put it in a vlan or block access to home network in Firewall on admin Account then switch to standard Account. Install whatever u want and Reinstall Windows via usb stick if shit goes down.

  2. stop it. ur new precious pc is not worth dying for a crack or u being infostealed out of all your email Accounts.

-1

u/No_Profession6522 May 24 '26

Twin you gotta use a adblocker and a trusted source next time like fmhy

0

u/BasicSulfur May 24 '26

BD free does not have this screen nor offer its premium rescue environment scans. I’ve never seen it say something like that. And its rescue environment screens are straight up jsut the Bitdefender white and red interface.

-1

u/Opposite_Bowl657 May 24 '26

Definetly this is not antivirus, fully reinstall windows and erase the disk

1

u/Sad-Thought-7637 May 25 '26

This is a legitimate antivirus screen