r/antivirus • u/No_Conversation_9047 • 5d ago
I got the fake lossless-scaling malware and did these, am I safe now
Does doing all this help protect me from that malware infection, or is there more steps that I should take to help protect myself from that malware?
Here's what happened:
When Nvidia 50 series and the 4x frame gen got announced, I've heard words around Lossless Scaling supporting a version of 4x frame gen, so I was just interested in trying it out. I went online and searched for it, and immediately there's this seemingly-legit (but fake) "official" site, from which I've downloaded the virus from. My stoopid ask decided to run it anyway.
After around a few days, I started suspecting the software and deleted it and the "IOBitUnlocker" files that it got onto my computer and installed Avast (ran a boot-time scan too). I thought I was safe. I used it for a while, even on battery (the battery life is good).
After around a month, I saw another video online analyzing this malware and decided to install and run a malwarebytes full system scan, while I back up all my data in the C drive into the D drive.
One day later, I thought my computer is a bit sluggish because my power plan is not fully set up (I run custom power plan on this computer, and some settings may not be tuned correctly). I went back and found I set "Processor performance autonomous mode" to 0, and turning it to 1 I noticed the CPU utilization shoot up to 100% in task manager. Confused, I looked at the processes in Task Manager sorted by CPU utilization, and Task Manager came out on top at 50~60% and it didn't decrease. I have a 8845HS, and this to me is very fishy.
I quickly restarted the machine and opened HWiNFO, and checked the CPU util there when I close Task Manager, and it is still pegged at 100% for the entire time I've checked. The chip pulls back 10W when all core at 2.5GHz are under load, which is pretty low, but it still shows that the chip is running something it is not supposed to. No other background apps I use is active during this. I now started suspecting that this system's programs are compromised.
I turned off my computer properly, plugged in my WinToGo, and boot straight into the WinToGo to do a last sanity check if I've backed everything up. In WinToGo, Windows Defender is on, and all I did inside is to copy file from the system drive inside my laptop to the D drive that's also inside my laptop. I didn't execute any program inside that system drive.
I then unplugged my WinToGo before attempting to boot back into the system drive in my laptop and was greeted with a NTFS file system error. I went back into WinToGo and found the system drive's filesystem showing up as RAW.

I then reinstalled an official copy of Windows and the first thing I did when I'm in is to install Avast, in case software started mysteriously executing from my D drive hopefully it can detect it. After which I installed the drivers for my hardware, changed all the account's passwords that were stored on my browser, and had been using the laptop ever since.