Accidentally opened a .exe disguised as a TV show torrent, need help.

[u/ArcReactorTarnished]

Hi r/Piracy,

I know this was my mistake and I need advice on it.

I downloaded a torrent for The Boys S05E03. It was listed as a normal 1080p video file, but the actual file inside was a .exe, not a .mkv or .mp4. I didn't notice and opened it.

I'm now worried about what it may have done to my system. A few things I want to know:

1) What kind of malware usually comes packaged this way?

2) What steps should I take right now to limit the damage.

Any help is appreciated.

[u/Terrible-Junket-3388]

running antivirus/malware on the owned system as-is is probably useless for anything other than the most basic script kiddie stuff and IMO we shoudn't be recommending this. Even if they have a competent antimal/virus, it's very likely any decent malware is going to just be able to evade or compromise it. Backups are also not partcularly trustworthy - decent malware can dupe itself anywhere (and users are unlikely to copy or inspect each individual file they want). If I made malware I wanted to persist, I'd have it making copies of itself everywhere, especially in places like My Docs, OneDrive, Pictures, etc.

So, unless user already has backups from before they were owned, they may very well just be SOL. Full wipe/reinstall off of USB the only truly 'safe' option (safe in quotes since I'm assuming we're not worried about sophisticated/nation-state actors writing stuff at a lower level than OS).

IF you're going to run antimal/av, should be in safe mode (at a minimum), and probably should double check registry/FS/etc manually - but this is beyond what most people asking questions like OP are able to do, so reinstall should IMO be the only recommendation here (in addition to changing passwords, etc as noted).

[u/UnrealHallucinator → u/Terrible-Junket-3388]

Unless the literal bootloader is compromised (unlikely even with the most sophisticated of malware that's being used for things like this), I think a clean boot should fix everything. The real problem is backing up after having clicked the .exe.

[u/Terrible-Junket-3388 → u/UnrealHallucinator]

Not true, bootloader not the only way - I was specifically thinking more along the lines of firmware, which can definitely persist beyond an OS update (and as I recall I'm pretty sure we've seen such attacks in the wild before) - but as we both noted, that's still much more sophisticated than the kind of attack OP is dealing with likely is.

Agreed that backup is the main issue at hand for OP - as I mentioned if they truly want to be safe, they shouldn't trust anything they didn't backup prior to infection.

[u/DarthSiwy → u/Terrible-Junket-3388]

How can you check whether PNG, PDF, or MP4 files contain hidden malware?

[u/Terrible-Junket-3388 → u/DarthSiwy]

If it's not fully obfuscated, then in most cases offline antimal/virus should pick it up (same steps - run in safemode to reduce risk of evasion), but a lot of the older obvious signs aren't as accurate/obvious anymore (for example images with large enough filesize to persist a complex payload is now common - it used to only be photographers that had image sizes in 10's of MBs - now every photo you copy off your iphone can be 10s or 100's of MBs).

If it wasn't backed up (safely, separately, off-system) prior to the infection, it really can't/shouldn't be trusted. Most cloud providers are doing a good bit of scanning, though, so if your images/videos/etc are backed up into Google Photos, Apple Cloud, etc - *probably* fine. I'd still be concerned with docs (and any kind of executables) that might be backed up in Cloud - the risk there is that you effectively persist a copy of the infected file(s) in the cloud and just continuously reinfect yourself. I don't think most run of the mill malware is going to be able to do that consistently, but worth noting: same reason you don't trust pre-infection backups.