I downloaded an application from a questionable website through a torrent. It worked for a couple of days, then my computer began freezing and displaying unusual pink and blue pixel patterns that looked somewhat like skulls. A scan of the original torrent did not detect anything, but I failed to scan the extracted archive before running it.
I later found detections identified as "Trojan:Script/Obfuse!MSR" and "Trojan:Win32/SuspMasqueradedRen-PyExe.C." After trying various Command Prompt and PowerShell cleanup steps in Safe Mode, I attempted to reinstall Windows using installation media created on another computer. The installation appeared to complete, but the system froze during setup and restarted. After repeating the setup, the strange pixel patterns returned.
I'm not sure whether this is still malware or possibly a hardware problem. What is the safest way to perform a genuinely clean reinstall and determine whether my computer can be recovered?
4 Answers
Before assuming the reinstall failed because of malware, consider hardware. Persistent freezes and colored, skull-like graphical artifacts can indicate a failing graphics card, display cable, monitor, system memory, overheating, or power supply. If the same artifacts appear in the BIOS or Windows installer before the hard drive is touched, malware is much less likely. Test with the minimum hardware possible and check temperatures and memory if you can.
The torrent file itself is generally just metadata used by the torrent client; the downloaded archive or executable is what may contain malware. Since the detections were serious, avoid running any recovered programs or connecting backup drives until they have been checked from a separate, clean environment. If the files are not important, wiping the drives is safer than trying to preserve them.
A USB-created installation should normally remove ordinary malware if you actually perform a clean install, so it’s worth checking exactly what happened. The installation media itself could have been created or modified on an untrusted computer, and leaving other partitions or drives connected can also reintroduce infected files. Make the media from a clean machine and disconnect anything that isn’t required for the Windows installation.
Create the Windows installation USB again using a known-clean computer. On the affected PC, reset the BIOS settings to their defaults, disconnect every other internal drive and external USB device, and make sure the computer boots from the installation USB rather than the existing Windows installation. During setup, delete every partition on the Windows drive and install to the resulting unallocated space. Do not reconnect other drives until the new installation is stable and you have installed security software.
The installation USB is easy to overlook as a possible source, especially if it was prepared from the compromised computer. Recreating it elsewhere and wiping the target drive completely removes that variable.