Hey, this is @eyuelzero. So I thought maybe I should write up something about this, assuming other people are facing the same issue. I remoted into sami's PC to investigate how it worked, and removed the malware manually. Here's a how-to on removing the malware that opens up a scary browser window every time you open your PC. 👻

1. Disable malicious startups
Open Task Manager, open the Startups tab, and disable any startups that are named Explorer. Disable msedge too.

2. Shutdown the malicious program
In task manager, go to the details tab, and look for svcnost.exe. Notice the difference between svchost (safe) and svcnost (malware). The latter one is the malware, and it should be at the bottom of the list because of the spelling. Right click and End Process. It should go away and come back within seconds. That's expected. Then below it, there's another one named svcnosts.exe, right click on that and End Process Tree. This should make both svcnost.exe and svcnosts.exe go away.

3. Discover and remove the malware source using CMD
Open up search, type cmd, and click on Run as Administrator. In the terminal window, paste the following list of commands:

takeown /F C:\sefera /R /D y
attrib -R -S -H C:\sefera /S /D
rmdir /S /Q C:\sefera
takeown /F C:\system_volume_lnformation /R /D y
attrib -R -S -H C:\system_volume_lnformation /S /D
rmdir /S /Q C:\system_volume_lnformation
echo done

Every line should be successfully complete, but if you see an error, take a screenshot and lmk.

4. Delete the Ethiopia folder on your desktop. Restart your PC and check if it's gone for good.

5. Prevent shit like this from happening again.
Please enable your damn antivirus. Windows Defender would have easily prevented this but you had to infect yourself cause you couldn't crack your software properly.

By the way, this is a common malware that transmits itself through USB drives. If you're curious, the source was "Show Hidden Files.bat" and its common neighboring .exe files you find in USB drives. If you don't know how to avoid being infected from USB drives, just install Smadav. Smadav is a little faster than Windows Defender and recognizes the most common USB malware that you can find these days. Even if it doesn't recognize the malware, it has additional features to prevent infections.

Good night ✨

"እግዚአብሔር ሆይ፤ ተስፋ ባደረግንህ፣ በእኛ ላይ ምሕረትህ ትሁን።"
— መዝሙር 33:22

#Scripture
@Dagmawi_Babi