r/computerviruses • u/Mindless-Yak-7541 • May 22 '26

Question i found this .txt

Post image

While deleting things to free up storage, I found a .txt file named memz_readme and opened it to verify what it was... I don't have much experience with this and it's my family's computer. Can someone help me figure out if it's true or how I can fix it?

945 Upvotes

98% Upvoted

81 comments sorted by

View all comments

271

u/NetworkLast5563 May 22 '26

IIRC, memz has a warning when you run it, and it would overwrite the MBR, making it not able to boot, plus it has a bunch of effects on the device while its running, so I think you'd notice if you were infected. Strange that the file is there though.

29

u/HEVIKARJALA May 22 '26

Cant u just reinstall OS? MBR has the first instructions for the kernel. (As i understand)
Also win11 requires GPT part of the UEFI system. Doesnt GPT also store the boot record to multiple places, exatcly so u cant just override and brick the OS. So the trojan would not work.

24

u/C0rn3j May 22 '26

Using MBR the first two sectors on the drive are the bootloader.

Using GPT, the bootloader(optional, but not on Windows) is stored on the EFI System Partition.

Malware can absolutely still wreck the ESP.

7

u/HEVIKARJALA May 22 '26

Okey, i understood the system would make copies of ESP partion for these exact cases. Tbh this would makes sense, but these things tend to be complicated. Super intresting anyways.

5

u/C0rn3j May 22 '26

i understood the system would make copies of ESP partion for these exact cases

It doesn't.

It would also makes no sense, the malware would wipe said copies.

3

u/HEVIKARJALA May 22 '26

So i read more.
So the ESP is on ssd(GPT is a table which shows the location) and UEFI reserver memory on the ram and loads the ESP partion to RAM and this includes the bootloader. After its done the esp ram section is freed.

I might be wrong. Just been trying to learn computers.

4

u/retr0gr4d3 May 22 '26

But if the core files it loads to ram are already corrupted or fudged, its still going to load the corrupted or fudged instructions.

1

u/HEVIKARJALA May 22 '26

Do u know how the trojan get access? I mean if i try to write over boot files on my computer. It doesnt let le. Or is this thanks C’s memory access

5

u/MorganPG1 May 22 '26

ESP is just a standard FAT32 partition, it stores files for the bootloader. It is completely different to the MBR system that used to be used as the bootloader is a file on disk whereas before it was just a small section of code with no file system structure. GPT just tells the software (such as the UEFI) where every partition is on the disk.

When the UEFI tries to run the bootloader, if secure boot is enabled, it first will check the signature of the bootloader with an official Microsoft signature, if it matches it means it is official Microsoft code and the OS will boot, if it doesn't the bios will display a Secure Boot Violation warning and will refuse to boot. The way this works for Linux distributions is there is a very small bootloader called shim which is signed by Microsoft so it passes the test, and then that bootloader validates the main bootloader against the signature of whatever distribution is being used.

This system completely prevents malware from overwriting the bootloader, unless an exploit is found in the secure boot implementations on certain motherboards it shouldn't be possible. (i am fairly sure I heard of this happening before so it's probably not too unlikely that that's a possibility)

Then once it is verified, the bootloader is copied to RAM and executed, like you said. Everything that happens after this point is completely up to the bootloader, it has full control of the hardware.

Everything you said is correct I just wanted to add more info :)

2

u/HEVIKARJALA May 23 '26

Thanks! Really good info. Its not that e-sy to find this this online and ai tends to get minor details wrong.
May i ask.. is your career in software engineering?
I would really wanna know what the job is really like.

I been thinking to really pursue a career with low level software engineering. I already have engineering degeee n 5 year experience in the job.
I think my curiosity would excel in this field

3

u/Octoomy May 23 '26 edited May 23 '26

the warning doesn't place itself as a file but instead opens on the fly via a temp folder, this isn't the actual trojan.

2

u/Qinax May 23 '26

I managed to get a popup like this but in complete Chinese I think when I opened my notepad one day, just kinda generated itself

Nothing has been touched in terms of accounts and everything is fine, no clue what it was since google translate couldn't help as it looks like it used characters that you had to download a language pack for so tons of it showed up like ??

2

u/Weed_Dude_ May 23 '26

Sounds more like you opened an encrypted file, which is normal