i get this virus from xnxx porn ads

Damn virus comes from porn ads Damn virus comes from porn ads_x000D_ Damn virus comes from porn ads_x000D_ Damn virus comes from porn ads_x000D_ Damn virus comes from porn ads_x000D_ Damn virus comes from porn ads_x000D_ Damn virus comes from porn ads

This is a virus that comes from advertisements and not from downloading programs. I am a programmer and I tracked it. This is a virus that infected my device through advertisements for porn sites. Please put an add-on to block and block advertisements to avoid this problem in the future.

Downloaded flstudio from 1337x, installed and then task appeared in task scheduler which malwarebytes detected. That task ran daily and created a fake log file which had a huge ass base64 string which turned out be a script which contains unknown websites and references to crypto (INCLUDING THIS ADDRESS) at the bottom, not sure if miner or ransomware.

I downloaded an alleged crack of software called Passper for PDF from The Pirate Bay, which was uploaded by user called MotasemBT. _x000D_ https://thepiratebay.party/torrent/57638901/Passper_for_PDF_3.6.2.3_Multilingual___crack_x000D_ _x000D_ Inside is crack.zip, which contains a malicious file called Activator.exe. I ran the program, clicked PATCH, which appeared to do nothing. I gave up and moved on to other tasks._x000D_ _x000D_ The next day (today) I pasted a BTC address that I immediately recognized as NOT the one I copied. I opened my clipboard manager, and sure enough, a hidden Powershell process replaced the address I copied, hoping I wouldnt see the difference. This has happened before; I lost $500 in crypto from an attempted transfer because I didnt notice the address difference when I pasted. This time I caught it right away._x000D_ _x000D_ You can find exactly what the malicious program does and how to undo the damage here: _x000D_ _x000D_ https://gist.github.com/infernoboy/cf114fda56ff3706478e0d1e6a1a1b27?permalink_comment_id=4140687#gistcomment-4140687_x000D_ _x000D_ 1. A task was created under Microsoft > Windows > NetService > Network that is spawning PowerShell. You can safely delete the entire NetService folder, as it was also created by the malware._x000D_ 2. Delete a fake log file that it created where it hides the script: C:\Windows\logs\system-logs.txt_x000D_ 3. It also replaces the contents of C:\Windows\System32\SyncAppvPublishingServer.vbs with its own version. A copy from a clean install of Windows 11 (works for Windows 10 as well) can be found here: https://gist.github.com/infernoboy/7cc1fe26e647dd08e6e63a201cb38e27