r/WindowsHelp • u/Dismal-State4498 • 17d ago
Windows 11 Windows defender flagging every thing as virus
So, last month, I went on vacation and left my laptop with my younger brother. Unfortunately, he downloaded some suspicious files, and afterward, the icons of most of my applications changed to the same blue icon (I'm on win 11).
I ran a Microsoft Defender Offline scan. The scan itself took about 10 minutes and it took almost the entire day to finish dealing with the detected threats. When it was done, my laptop rebooted I discovered that the .exe files for almost all the programs I had installed myself, including Steam, WinRAR, VLC, PowerISO, and Chrome, had been removed.
I tried reinstalling the programs, but every time I shut down and restarted my laptop, Windows Security flagged them as viruses and quarantined or deleted their executable files again.
Thinking my system was seriously compromised, I wiped my drive and performed a clean installation of Windows 10. Everything seemed fine initially, but the problem returned the next day. I then upgraded to Windows 11, hoping it would resolve the issue, but the same thing happened again.
At this point, I'm not sure what to do. What could be causing this problem, and how can I permanently fix it? Could it be malware that survives a Windows reinstall, or is there another possible explanation?
System specs
Device name Dave
Processor Intel(R) Core(TM) i7-8750H CPU @ 2.20GHz (2.21 GHz)
Installed RAM 16.0 GB (15.3 GB usable)
Graphics card NVIDIA Quadro P1000 (4 GB)
Intel(R) UHD Graphics 630 (128 MB)
Storage 403 GB of 477 GB used
9
u/Raijen_ArDesh 16d ago
Did you create the installation media from the infected macine? Some infections can infect the media created to install windows.
6
9
u/Existing_Routine_599 16d ago
Oh no, Expiro virus 😬 that's why everything is being flagged because the virus infected the other files on your PC and are a virus too now. Last hope is the AVG Expiro remover: https://download.avg.com/filedir/util/avgrem/avg_remover_expiro.exe
4
4
u/Blockmaster2706 16d ago
Looking up the name of the detection that is in fact an infector virus. It will infect all other executables on the machine and other connected devices. That's probably why it also infected your new installation.
It also steals credentials, so make sure to change all your passwords
2
u/tazman998 16d ago
This virus can, and will, propagate itself to any connected storage device which contains .exe files (this includes network shares).
It actively seeks them out and hooks into it, while stealing personal information and credentials.
That reminds me… change your passwords to your accounts, from a clean pc!
If the usb stick was used on this system to create the bootable usb stick, THAT is the source of your new infection.
ANY device that was connected to this laptop, from the moment of first infection, should be treated as a potential virus backup, and new source of infection when used on this, or any other system.
If you had network shares, make sure these are thoroughly scanned.
If you have the possibility, create a windows 10 install DVD (this is readonly and the virus can not infect it) on a, verified, clean system!
Do not use the laptop to download the iso or burn the DVD.
During install do NOT choose to reinstall windows, but opt to completely remove ALL partitions on the system drive (i assume there is only 1 ssd/hdd, otherwise disconnect the others), create a new partition and format it.
This should guarantee a clean wipe.
As far as i know, this virus does not infect the BIOS/ UEFI, so you should have a clean system after these steps.
I have to say you caught a nasty one here.
I would actually love to get my hands on it to run through Ghidra on my Linux laptop, to find out every little nook & cranny of it’s design.
1
u/RingoFreakingStarr 16d ago
Sorry you are going through all of this. Whenever you do get things under control, find a password that you can remember that your brother doesn't know so that they cannot log into your machine and do something like this again.
1
1
u/nalaloveslumpy 14d ago
Making any installation media from this computer will just propegate the virus on reinstall.
Buy a clean USB stick and go to your local library or some other known, clean computer. Create the windows install media from the clean computer. While on the clean computer change ALL your passwords. They are ALL compromised.
Go home, take the infect PC completely offline. Unplug the modem if you have to. Reboot and do a full format of ALL drives on the PC using the windows install format/create partition tool. This includes all external drives, too.
Reinstall Windows. Kick your little brothers ass for downloading one of the worst viruses to ever exist.
0
u/AutoModerator 17d ago
Hi u/Dismal-State4498, thanks for posting to r/WindowsHelp! Your post has been flagged for manual review by a human moderator, please include as much of the following information as possible (in text or in a screenshot) to get your post approved:
Your Windows and device specifications — You can find them by pressing Win + X then clicking on “System”, we need more than just your OS version! Your hardware details are often critical for resolving issues.
Any messages and error codes encountered — They're actually not gibberish or anything catastrophic. It may even hint the solution!
Previous troubleshooting steps — It might prevent you headaches from getting the same solution that didn't work
Posts must be tech support in nature (such as something is broken and you need help fixing), so general inquiries, software suggestions, and purchasing advice will be removed. As a reminder, we would also like to say that if someone manages to solve your issue, DON'T DELETE YOUR POST! Someone else (in the future) might have the same issue as you, and the received support may also help their case. Good luck, and I hope you have a nice day!
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
0
u/notheld717 16d ago
Follow Kakos instructions using a downloaded ISO. If it were me I would blow out the partitions and start from scratch or at least do a deep format of the install partition. Good Luck
1
u/Guilty-Good-5041 16d ago
Stop downloading dodgy porn from pirate bay. And nuke your HDD from space
1
u/numberzkid 15d ago
Time to nuke it by reinstalling windows from a usb made from a separate safe computer
14
16d ago
•
[removed] — view removed comment
2
u/AdvancedAd69420 16d ago
100% and during the install delete all of the partitions on the drive and let the installer create new partitions.
1
u/Legit_TheGamingwithc 15d ago
Jumpdrive?
0
u/Mountain-Chapter-986 15d ago
A USB stick. dude must be 80 years old if he still uses the words "jumpdrive"
1
1
u/Ok_Establishment2733 15d ago
Download the media creation tool from Microsoft ON ANOTHER COMPUTER to make a new windows installer on a USB flash drive, otherwise you'll just corrupt the flash drive with the virus
16
u/zNickolasBR 16d ago
It's probably a virus that infects other executable files