What’s happening on the forums?

Some sneaky folks are impersonating helpful gamers and replying to troubleshooting posts with one-line PowerShell commands that supposedly “fix” crashes, missing items, or other game gremlins. Don’t be fooled — this is a classic ClickFix attacks scenario: a social-engineering trick where victims are encouraged to run a command themselves, which then pulls down and runs a hidden payload.

The faux utility in this campaign pretends to be a Windows tune-up tool (think: faux optimizer dialog boxes, fake progress bars, and reassuring text). While the interface looks like it’s doing maintenance, the real work happens behind the scenes: the script disables certificate checks, demands admin rights, and fetches a cryptominer.

How it works, plus how to spot and clean it

In short, the script will try to:

  • Create a folder at C:\Windows\Background and add it as a Microsoft Defender exclusion.
  • Stop or remove other miners and configuration files, then quietly download a new payload and move it to C:\Windows\Background\system.exe.
  • Create a scheduled task named like XMRig-[computer name] so the miner runs with SYSTEM privileges at startup and add a temporary firewall rule to allow outbound connections.

The actual coin-stealer is the XMRig miner, dropped as an executable and launched with high privileges. Because a human typed the command, some automatic defenses may not catch it.

If you think you or someone else ran one of these commands, check for these telltale signs:

  • The C:\Windows\Background folder exists.
  • A Defender exclusion for that path is configured.
  • A scheduled task starting with XMRig- is present.

Cleanup checklist:

  1. Disconnect from the network (optional, but useful if you suspect active mining).
  2. Run a full antivirus/antimalware scan and remove anything it finds.
  3. If the scanner misses the miner, stop and delete the scheduled task named XMRig-[computer name].
  4. Remove the Defender exclusion for C:\Windows\Background.
  5. Delete the C:\Windows\Background folder and any files inside it.
  6. Consider a full OS reinstall if you can’t be sure no additional backdoors were installed.

And finally, some low-effort, high-impact advice: never run PowerShell commands pasted in forum replies or DMs from strangers, no matter how convincing or urgent they sound. If someone offers a fix, ask for details, test in a VM, or consult an official support channel instead of doing the digital equivalent of sticking your hand into a mystery cookie jar.