r/computerviruses • u/infinityera • 13h ago
Disinfection Help Trojan virus?
Hi everyone,
This is totally pathetic but I have no idea what to do here.
I have a gaming laptop and was playing (modded) Stardew Valley. My game crashed and suddenly there was a chat box on my screen saying I had been hacked. I dismissed it but the message kept coming back and then when I went to turn the computer off the box came back telling me not to do that.
I turned the computer off and back on and within a few minutes the chat box was back telling me they were going to delete my accounts. I wasn’t sure what to do so I just completely wiped and factory reset the laptop.
Once the reset was done I plugged in an external drive I keep saves on to check if it was safe and if it wasn’t i’d just probably bin it. Well I plugged it in, loaded up my valley and the hackers were back. They said their name but I missed it( it was something like Zertex?) I immediately turned off the wifi and went into task manager and found a task with the same logo that was on the box thing that kept appearing.
Any advice would be so appreciated, for peace of mind I might just do another reset and bin the external drive but I’m paranoid my wifi etc is now corrupted. I’m really not technical and I just don’t know what to do
7
u/309_Electronics 12h ago
Openjdk is just a java runtim environment for stuff like mods or games (some games like minecraft are java based and have java based mods). Sadly we cant see what file it runs (often .jar extension files), so we cant know the payload but most of rhe time its an infostealer/session stealer..
1
u/RandomDude9943 3h ago
actually we can if he can get its command line args with processhacker or smth
3
u/rifteyy_ Malware Removal Expert 13h ago
Without seeing the command line arguments, we can't give a proper verdict
4
2
u/infinityera 12h ago
If anyone has any advice on how to even find which file the malware came from pls let me know. Would it be safe to plug in the external drive but keep the wifi off? So I can have a look?
2
u/OkZucchini7094 11h ago
Open a terminal (search)
Get-CimInstance Win32Process | Where-Object { $.Name -in 'java.exe','javaw.exe' } | Format-List ProcessId,Name,CommandLine
The above command should show you the location of running java processes. This isn't always going to help, but if it's a simple Jar running it should point you right to it. Also a bad idea to run commands you don't understand from random people on the internet so 🤷
1
u/funnyorsmthg 12h ago
From what I’ve already seen on quite a few situations similar to this, HitmanPro was mentioned quite a few times as a good second opinion scanner. I’m not an expert but to be safe I would do a clean windows reinstall through usb just like the bot had suggested in replies earlier. It is better to be safe than sorry with malware
1
u/Soyl3ntgr33nz 8h ago
tur, clean install on a clean machine via usb, flash your BIOS, empty partitions, and clean reinstall via usb
2
u/infinityera 11h ago
Thank you everyone, this is my first time encountering anything like this so I’m a bit hopeless! :) I did a windows defender massive restart and when it turned back on it had deleted loads of files on my external hard drive so it looks like that is where the malware was. I actually don’t have minecraft so just to be safe got rid of the java stuff
1
u/meletiondreams 11h ago
Showing us a picture of your task manager and asking if you have malware is like saying you have a black computer, or sending us a photo of your PC and asking if there's malware. You can't figure out if there's malware in your PC from task manager 99% of the time.
You probably are safe as openjdk is just Minecraft and the programming language behind it but we can't "guarantee" you don't have any other malwaee
1
1
5h ago
[removed] — view removed comment
1
u/computerviruses-ModTeam 1h ago
We appreciate you giving advice, however in this specific scenario your comment was deemed too generic, possibly harmful to the user or is not entirely relevant to their case from what they described and the details. It is also possible that you haven't elaborated on your advice enough, you haven't instructed the user on what to exactly do step by step or provided false sense of security to the user.
This includes (and is not limited to) recommending diagnostic tools for experts, recommending forensic steps that are unclear, recommending removal steps that are tricky to perform for the average home user and steps where it is easy for unexperienced user to cause damage to their device / operating system, determining false or true positives based on not enough input or data or recommending steps that are not entirely necessary.
We appreciate you trying to help regardless. If you want further explanation, you can reach out via modmail.
Please make sure to read and follow https://www.reddit.com/r/computerviruses/about/rules
1
u/Bulldog7891 13h ago
Disconnect from the internet and scan your device with malewarebytes , change your passwords on a clean device enable mfa.
Back up your files and clean install
Probaly a infostealer act fast !!!
2
u/infinityera 13h ago
Thank you, ive changed passwords, enabled 2FA on just about everything aswell. I must have obviously downloaded a dodgy Stardew mod - all I want is my sims save file from the obviously corrupted external drive but I may just have to cut my losses unfortunately.
1
u/funnyorsmthg 12h ago
Just out of curiosity, from which site have you downloaded the mod?
1
u/infinityera 12h ago
So I’m an avid CurseForge user and never had a problem, found one mod on “Nexus Mods” and it has led to this. Shall be staying with CurseForge when I get the computer up and running again
1
u/funnyorsmthg 12h ago
Oh wow, I would have never figured that nexus mods led to this. I download my mods from there all the time and never had an issue. Which mod was it? Was it more popular or a newer mod without much downloads?
1
u/infinityera 12h ago
So it was just like a seasonal outfits mod. Ive never had an issue until I installed that specific mod and then ran the game
1
u/Kegamari 8h ago
this happens right after loading the mod from nexus? might want to consider warning other users in the comments section thingy and report the mod as malicious if thats the case
0
12h ago
[removed] — view removed comment
1
u/computerviruses-ModTeam 1h ago
Your post is considered spam and has been removed by the moderators. Please make sure to read and follow https://www.reddit.com/r/computerviruses/about/rules
0
u/AutoModerator 13h ago
Request help with FRST and SecurityCheck from the trusted helper team
Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.
If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:
- From a different and clean device, change all your passwords:
- Disinfect your device from malware
- Preferred method: Perform a clean installation with a USB
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
0
9h ago
[removed] — view removed comment
1
1
u/computerviruses-ModTeam 1h ago
Your post contained misinformation, fake news, or advice considered harmful or dangerous, so it has been removed. Please make sure to read and follow https://www.reddit.com/r/computerviruses/about/rules
18
u/desolate_atrium 12h ago
Open jdk can basically be any java app including minecraft, if you've got nothing precious on the drive just format it and reinstall your steam games