You're viewing a single thread.
Around 2013-2014ish when the fake FBI viruses when commen, I worked at a tech help desk at my university fixing student computers.
We didn't have a bootable virus scan avaliable but I discovered it you ctrl-alt-deleted you could tell the system to log out, it would close everything and log out.
but if during a split second when the device was turning on before the virus blocked the screen and actions you opened a word doc or something,
then when you logged out it would close everything (including the virus's window that was blocking the screen) but the word doc and ask if you wanted to save the document first. By hitting cancel it would stop the logout completely and we could run the various virus scans to get rid of it.
This reminds me of way back when i beat a virus with task manager.
This one was showing as a process in task manager. If you killed it, it would just reappear moments later. I even tried finding the folder it was installing on my pc via rightclick on the program in task manager and clicking "open file location" closing the program and deleting its install folder. But it would still come back, installed somewhere else.
After some time messing around, i noticed that another program would show in the task manager, then the virus would appear, and then the other program would close and disappear from the task manager. All within about 1 or 2 seconds
So i killed the task, waited for the other program to appear right click it fast, open file location, and there it was, a different folder with a program that auto runs when the virus is removed to reinstall the virus and close itself to avoid detection.
I deleted that folder and then killed the virus program in the task manager, and it didn't reappear. I had won!
I seem to recall it was resistent to virus scanners for this reason.
But this was about 20 years ago so i doubt there are viruses that unsophisticated now.
I had something similar. I was looking at my processes one day for some reason, when I noticed CuteFTP. Now, I knew what it was, but I knew for a fact that I hadn't installed it. Some investigation led to a hidden folder containing some scripts. One of them was for remote control via an IRC channel. So I hopped in the channel and had a chat with the user who was set to admin the bot on my computer.
Edit: Formatting.
Yeah around the same time as those fbi ones there were ones like that but they generated new ones with randomized names trying to hide. I think
Fucking baller status. There were a couple of fixes, not as complex as yours of course, that I figured out during the wild west of internet and virus infection. Can't remember any of it in detail, but yeah, shit was it's own kind of puzzle and was awesome to find a fix like this.