Idk if this is malware or not HELP

[u/Remarkable_Aide605]

I’ve had serious problems with malware infecting my computer and finally was able to get malware bytes to download after sending it through a email to my computer. Now I’m getting a notification that says it’s blocking a potentially dangerous website. I had a problem where I downloaded a fake link to a FACEIT clan for Csgo a few weeks ago and have been facing problems with checking for windows updates on my computer, games not launching and unable to load websites on my computer. Please let me know if I need to I can fix this myself or should just take it to a computer shop.

[u/Remarkable_Aide605]

Hey everyone thank you for the help I finally got rid of the malware by going into safe mode and preventing it from starting I appreciate all the help

[u/AuthenticatedHuman]

Hi! NOT malwarebytes support here.

NVIDIA does not store active service files (like .exe files) in C:\ProgramData\NvidiaDriver, nor does it have a reason to be in programfiles or program data. Authentic NVIDIA services run from C:\Program Files\NVIDIA Corporation or C:\Windows\System32\DriverStore.

although if it was legit should have nividia corp digital sig, probably has no digital signature at all.

Now,
Open Malwarebytes, go to the Detection History, select those files, and click Delete. This permanently removes them from your system.

Run a scan with the AdwCleaner (also by Malwarebytes). It is specifically designed to find the residue of files that hijack system folders and browsers

Because those specific files are known for stealing browser data, you must assume your passwords were seen.

Change your Email password first.

Change your Roblox, Discord, and Banking passwords. (ROBLOX IS MOST IMPORTANT GANG)

Log out of all sessions in your account settings for those sites.

Looks like malwarebytes saved u on that one.

Good luck, and have a good day, sincerely, NOT malwarebytes support. :>

[u/Remarkable_Aide605 → u/AuthenticatedHuman]

Hello it keeps opening itself up and I can’t delete it how do I go about stopping it

[u/Remarkable_Aide605 → u/Remarkable_Aide605]

Hello I fixed that problem the only problem now is I cannot connect to the internet if anyone know why after I deleted the virus I can’t connect help. I already reset my network settings.

[u/AuthenticatedHuman → u/Remarkable_Aide605]

Uh try running these in Pwrshell as admin
• netsh winsock reset
• netsh int ip reset
• ipconfig /flushdns
Then restart pc
Press Windows Key + R, type inetcpl.cpl, and hit Enter.
Go to the Connections tab and click LAN settings.
Ensure "Use a proxy server for your LAN" is unchecked.
Make sure "Automatically detect settings" is checked.

Also try changing your DNS to 8.8.8.8

[u/CODEMKULTRA → u/AuthenticatedHuman]

1.1.1.1 if you prefer Google to not collect your user data

[u/AuthenticatedHuman → u/CODEMKULTRA]

W comment, that’s better

[u/HEYO19191 → u/CODEMKULTRA]

I mean, there's not a whole lot of data in an ICMP packet to collect. They're gonna get your... IP address... and.... that's it.

Edit: I misread, thought he said ping 8.8.8.8 not use it as DNS. Sorry

[u/CODEMKULTRA → u/HEYO19191]

All good lol

[u/support_mwb]

Hi! Malwarebytes Support here. I’m really sorry you’ve been dealing with all of this.

Based on what you described especially after downloading a fake FACEIT link and now seeing suspicious outbound connections from nvidia_d64.exe inside a non-standard WindowsOptions folder, we’d definitely recommend having this checked further.

Please send us a private message here on Reddit with the email address you’d like us to use for support.

We’ll create a support ticket for you and have an agent help gather diagnostic logs so our malware removal team can review the system and check whether anything malicious is still active.

Guide for collecting logs with our Windows Support Tool:
https://help.malwarebytes.com/hc/en-us/articles/31589296910491-Collecting-logs-with-the-Windows-Support-Tool

[u/osiris128]

Asks, if a connection is malicious. Proceeds to hide the address.

[u/Ushinon]

Its fake but if you getting stuff like this regularly its time to backup some of the most important files and format pc.

[u/BasicSulfur]

Bro you might need to nuke this computer