So, I recently tried using Cheat Engine for a game called Nightreign to recover some lost items, but I suspect the official website has adware that installed some bad stuff on my computer. Malwarebytes has been alerting me about a PowerShell payload process that apparently activated from a location in my AppData folder related to Opera GX. However, I can't find that specific location on my PC, though I do see some files for Opera. Initially, I thought Malwarebytes eliminated everything, but the alerts keep coming back. I don't have a disk to reinstall Windows 10 and I really don't want to lose all my files. What options do I have to fix this?
3 Answers
Honestly, you'll want to be careful here. If you haven't done so already, turn on PowerShell logging to see what commands have been executed because any files you keep might still be compromised. Be wary of keeping any data, as it could lead to bigger problems down the line. Sometimes, when dealing with malware, a complete wipe and reinstall, though painful, is the easier long-term solution. Also, the path you've mentioned only indicates you have Opera GX installed, but there could be more to it.
This is the risk you take when you download software like this. If you're going to reinstall, I highly recommend creating a separate admin account for elevated tasks so that your main account stays safe and you avoid any future issues. Normally, using mods from reputable sites like Nexus Mods is a safer bet.
You should try rebooting your computer in safe mode and run Malwarebytes again. That way, any malware that's present won't be able to interfere with the scan.
That didn’t work for me. It kept crashing whenever I tried running it in safe mode!
That’s a great tip! Having a separate admin account really does seem like a smart precaution.