NeoProgrammer infected my laptop #18
Description
Taking the issue #7 as a reference as it's completely related to what happened to me yesterday afternoon during my internship hours.
@lvent is right, those aren't false positives at all! I made the mistake of blindly opening this piece of crap on my personal laptop and got infected. You said that you believe that AV software may give false positives and that you don't trust this kind of software but from my awful experience I can guarantee that even Windows Defender that barely protects my PC was able to flag those files as malicious, even though it didn't stop their operations.
As I'm not just some random kid who barely touched a computer before doing this, when I saw that all of my previously downloaded exe files were popping back up with a last edit date of 13/02/2025 (DD/MM/YYYY) I had the good reflex of immediately turning back on Windows Defender then when I saw that it detected threats I cutted off any kind of access to the Internet on my laptop and rebooted into safe mode. From there I used some 2nd opinion scanners and Eset Online Scanner (not an ad) did an almost perfect job at removing those, including exe files that were in my Downloads folder and that got infected by this malware. I also dug through the Event Viewer and a tool from Nirsoft to go through Windows Defender logs (see Scr1 and Scr2 for proof - the 1st line in the logs is unrelated to this) and found out that it did a proper job at removing those from my PC, except the now broken 2 startup entries that I had to manually remove using Autoruns.
Scr1
Scr2
As I wanted to know if the driver installer or NeoProgrammer was the malicious program that made me lose an entire afternoon (and made me put BIOS chips reading besides) and a few hours of sleep I decided to run those (tried NeoProgrammer first then stopped when I saw that this was the culprit) on Any Run and found out that NeoProgrammer was the problem (see Scr3). (Any Run results)
Scr3
The infection and AV flags are completely unrelated to unsigned drivers as most of those would only be able to run in test mode or if you rebooted in the WinRE and chose to disable drivers signature enforcement at the next boot ; the real reason is that AVs usually compare those files signatures (or more commonly called hashes) with their databases to check if it already got flagged as malicious or not...
You can also re-open the issue #7 as you now got evidence that I got infected.
While not opening this in a VM and trusting this repo blindly was a big mistake from my side you're still responsible of the files you share in this repo thus you're also responsible for my infection.
If you don't think that's enough evidence I can also post a proper video on YT with how you can get infected and how to get rid of this without necessarily reinstalling Windows... (I could've reinstalled Windows but I prefer wasting half a day, a few hours of sleep and my browsers cookies than wasting days reinstalling and configuring 200+ programs and then log back into all of my accounts.)