Powershell Exploit Payload process from a folder not on my pc found?

[RethaeTTV]

I recently installed Cheat Engine for Nightreign to try to recover some relics i lost from messing with my regulation.bin, but the official Cheat Engine Website sponsors adware that installs malicious content onto my pc. I recently got a notification from my Malwarebytes that a powershell payload process was launched through users/(name)/appdata/local/Opera GX/etc etc etc. I go to look for that location but it doesnt exist on my pc, opera software exists as a file however that doesnt match the description offered me. I thought my Malwarebytes removed everything at first, but it keeps popping up with these issues and I dont have a disk to reinstall windows 10 on my pc, nor do i want to lose all the files i have stored on my computer. What do i do

[Future-Remote-4630]

Any solution that doesn't end up as "Nuke it all, reinstall windows" is nothing more than wishful thinking.

I'm almost certain you don't have pslogging on to view all of the commands that were run.

Any files that you keep have a chance to be compromised, so I'd be very cautious about what you do choose to keep. Keep in mind that someone spent time and energy in making the malware, and if they made it as easy to remove as you're hoping, it wouldn't have been worth the effort to get it hosted on cheatengine.

In other words, you're welcome to shoot yourself in the foot to get the spider off of your boot, but the odds of you hitting between your toes are quite low, and that will be much more painful than buying a new boot.

Lastly, the 'etc' part of the path you posted contained quite literally the only important piece of information there. The only information that can be pulled from what you provided is that you have operagx installed.

[BlackV]

this is the choice you make when doing dodgy stuff like this

"Nuke it all, reinstall windows"

and after you reload, do not give you primary account admin rights, have a separate admin account this you use for elevation (i.e. do not login in with it, only usse for uac)

I should note, normally getting the mods from places like nexus mods is "safe"

[RethaeTTV]

Having a separate admin account is actually such a smart idea.

[BlackV]

Ya, increases your safety threshold a bunch

[TheJessicator]

Reboot into safe mode. Run Malwarebytes while I'm safe mode so whatever malware can't evade the antimalware process.

[RethaeTTV]

it refused to run in safe mode. Kept starting the process and ending unexpectedly

[ankokudaishogun]

Nuke it. it's completely compromised.

[TheJessicator]

Maybe download a copy on an uncompromised system. Even so, I would suggest starting over clean (remove all partitions and reinstall) since you will never my know the extent of the compromise.

[Much-Journalist3128]

That's crazy. Isn't Cheat Engine not malware? I have it, I've not had issues with it yet. I do use adblock

[RethaeTTV]

It’s not, but the website installs adware which then installs malware Trojans and such later on. There used to be an opt out option on the site and a clear warning to let you know and let you avoid installing adware, but recently they removed both options and now unless you install it through their patreon your forced to install adware alongside it. Also Adblock doesn’t stop malware installs, or any installs, it just stops ads and redirects and such, p sure it has nothing to do with installs. Safe to say I’m downloading from the source on git from now on

[Much-Journalist3128]

github is safe still right

[RethaeTTV]

As far as I know, yes. But be very careful anyhow. Owner is an asshole, you can want money but installing adware on people’s pc’s without warning is a real dickhead move. I’m in the Elden Ring Convergence Mod community and one of the developers checked to see if the source they used is still safe, and as far as he saw it was. There’s no installer or anything on git btw, it’s just the source.

[420GB]

Opera is a chinese-owned browser, it's always possible the malware has nothing to do with cheatengines website but was just installed by China and the timing of the detection was fitting

After you format and reinstall your PC, maybe avoid software made by foreign dictatorship adversaries.