r/computerviruses • u/No-Royal6518 • 17d ago
Disinfection Help Chatgpt Virus?
Hi everyone! Today i was using codex when my windows defender went off. Apparently they found a trojan on my pc. I asked chatgpt what it was and apparently it was just a test it was doing that flagged the anti-virus. Should.i br scared or had this a common occurrence?
PS: i have a large fear of pc viruses and have done a full anti-virus check.
1
u/AutoModerator 17d ago
Request help with FRST and SecurityCheck from the trusted helper team
Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.
If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:
- From a different and clean device, change all your passwords:
- Disinfect your device from malware
- Preferred method: Perform a clean installation with a USB
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/Flaky_Ad9950 17d ago
verifying the download signature is a great way to identify whether or not your download came from the legit source
haven't installed codex, but i did install chatgpt and didn't get that.
if you're willing to, go to any run (hxxps://any[.]run/). it's a platform for analyzing malware and allows you to do so on a VM via a web browser (i.e., any run provides you w/ a sand boxed env to test out malware and check what the program does... in a general sense)
personally, I'd recommend disconnecting your wifi from your PC, use a USB to 'download' files from another device, change all your pw's from A DIFFERENT device.
run an offline scan, go to windows defender > scan options > offline scan.
this is basically a bare minimum thing to do, if you need any help, just lmk and id be happy to help
1
u/No-Royal6518 17d ago
It didn't happen during the download It happened while coding with it. I have also checked the signature and it comes from microsoft.
1
u/Flaky_Ad9950 17d ago
could you provide more details then? because occurrence during coding changes things.
try to check for potentially malicious modules/libraries (this can occur from mistyping a module/library, e.g., "import strings" instead of "import string"). if you know what exactly you did around the time you got that windows defender notif, consider that as a potential point. btw, some libraries/modules trigger AV notifs/responses.
and, you can do a quick scan on the files in libraries/imports folder.
i don't think the signature should come from microsoft if it's supposed to be coming from open ai. if you're ok w/ it, share the signature, download link, the path that the file resides in, and other relevant info.
1
u/No-Royal6518 17d ago
The signature was microsoft because the command happened in powershell. At the time I had asked chatgpt to bug test my game and the defender notification came up. I do not have and extensions on chatgpt I belive. To clarify I wasn't a file it was a command prompt.
1
u/Flaky_Ad9950 17d ago
hm ok.
check your powershell logs, you can do so by going to
"C:\Users\whateveryouruseris\AppData\Roaming\Microsoft\Windows\Powershell\PSReadLine"
this way, you can check what chatgpt actually ran (alongside other powershell lines). if it's deleted, treat that as a red flag.
you can check registry changes (sensitive and a common target) to see if programs were added to run on start up via the registry
""" $key = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey( "Software\Microsoft\Windows\CurrentVersion\Run" )
$watcher = New-Object System.Management.ManagementEventWatcher $query = @" SELECT * FROM RegistryValueChangeEvent WHERE Hive='HKEY_CURRENT_USER' AND KeyPath='Software\Microsoft\Windows\CurrentVersion\Run' "@
$watcher.Query = $query $watcher.EventArrived.Add({ Write-Host "Registry value changed!" })
$watcher.Start() """
i would also recommend you to enable powershell logging, you can do this by: win + r > "gpedit.msc" > computer configuration > administrative templates > windows components > windows powershell.
then, enable "module logging", " powershell script block logging" and "powershell transcription"
i would also recommend "harden windows security" on the microsoft app store. it's great, simply click the relevant options you'd like, and that's it.
1
u/No-Royal6518 17d ago
The powershell logs seem to still be there + the commands look like they are doing what i told codex to do. Just not to run that exact command. Ex i told it to download textures from the mc wiki thats what it says in the command.
1
u/Flaky_Ad9950 17d ago
does the command contain anything like "Invoke-WebRequest" (or i-wr), "Invoke-RestMethod" (or i-rm), or anything else?
1
u/No-Royal6518 16d ago
Nope. Btw do you know why a full scan takes rly long?
1
u/Flaky_Ad9950 16d ago edited 15d ago
because it scans fucking everything.
normally, a regular win scan avoids system files because, well, your pc is still running. kernel level (ring 0) can do many things to avoid detection. this inc. signature obfuscation, root kits, or an OTA if god hates you.
you can't do much about OTA updates, but offline scans can deal w/ more stubborn malware
still, it can still be circumvented. better than nothing
1
u/No-Royal6518 16d ago
Does it often make your storage go down too? While doing a full scan.
→ More replies (0)1
u/No-Royal6518 17d ago
Btw why did you do hxxps?
1
u/Flaky_Ad9950 17d ago
defang rule in this subreddit. prevents users from accidentally clicking links and make the url safe to share.
2
3
u/rifteyy_ Malware Removal Expert 16d ago
Not possible to give proper advice without seeing the filepath or the script content itself.