Repairing the WORST infected computer

Hello, my friends! Let's hit 10000 likes? Check out my website! enderman.ch
Today I am going to show you the process of repairing the worst infected machine. A year and a half ago I've performed the greatest malware run called Malware10 which spanned 6 months. I downloaded far and wide up until the point the computer was completely unusable. In this video I am going to undo that damage.
Links:
Full uncut footage - • Repairing the WORST in...
Timestamps:
0:00 - Intro
0:24 - History
0:58 - Infection
1:35 - Backup
2:33 - Restoration
12:35 - Comparison
13:25 - Final product
14:10 - Outro
Still got questions? Don't hesitate, send them to [e-mail]!
Hope you have a great day!
#endermanch #experiments #malware

[@tipoima]

Yea, no way I'd use that installation even after the clean up. Even tho I can't be sure there are any, I'd be too concerned about any more deeper-rooted malware still remaining after. Paranoia would kill me.

[@_1onlychxrry]

no

[@error__exe8735]

@@_1onlychxrry yes

[@GunnerSiIva]

He even said it at the beginning

[@XRADOFFICIAL]

With such an infected computer, a simple removal can not always help in particular that the viruses will be on the disk in a hidden trash can or there will be remnants in free sectors on the disk (free space) Then you have to permanently delete the file (Shift+Delete) instead of deleting (delete).You should still remove the free space, and when changing the system wipe the disk.

[@waseemshehab5276]

The Best video keep it up😃🙂🙂🙂🙂

[@curaphix]

I just love the sheer audacity you had to infect a computer with malware, proceed to say it is your best one yet, and then make a copy of it before getting rid of the malware.

[@user-dingus-dingus]

Gigachad move

[@cybergeist8932]

wait he infected his own computer dafuq?

[@imanjx2914]

@@cybergeist8932 No, basically he can plug it back on his PC with good antivirus and then wipe that disk and thats it.

[@Fireball7428]

One of those that he didn't need, to be exact. This infected machine was a test subject for that kind of experiments.

[@thomasvakyren]

Worked in a repairshop for a while and did this sort of thing. I can confidently say that I can already hear a whiny customer complaining about his icons being removed, despite nearly all of them being pup's.

[@escapetherace1943]

let me guess, it was a boom boom too I always am completely flabbergasted how they manage to get so much malware, even if you give them all the tools to be safe

[@TTMS-Khaz-kun]

@@escapetherace1943 Some people should simply not have access to the internet, because that is the result.

[@mrkemblegilstrap]

hi! What's a pup? ty

[@escapetherace1943]

@@mrkemblegilstrap PUP is "suspected malware, but not specifically known as malware", or simply programs you don't want that somehow installed themselves. The abbreviation stands for 'Potentially Unwanted Program" P U P = PUP. Most of the time the nonsense programs you see that pretend to or are widgets that serve little to no function and are likely datamining or stealing information from you. Usually pups end up on a computer by someone who doesn't understand the risks of the internet and simply launches everything they download, even more so people who click on bad ads or follow ads from other ads and allow them access to the browser, etc. Practically everything bad you don't want on a PC comes from people clicking on garbage while browsing the internet. I suggest staying only on safe sites, using something like malwarebytes, installing something like uBlock origin to protect you and remove unwanted ads, and running all executables from places they could've been laced with malware through at least two different, good malware scanners. Combine this with scheduled back-ups and malware checks and you'll be good to go. Also only accept necessary or no cookies in most of cases.

[@Sammysapphira]

​@obergilstrap88 pop up program. A form of adware that loads pop up web pages that have basically no use other than to scam and advertise.

[@kroezelgaming]

me at 8 years old when I got my first pc vs my dad trying to fix it

[@Bantopia_]

W dad

[@automatedinsanity]

In most cases it’s the opposite

[@NatK2010]

@@automatedinsanity Yes. That happend to me. My Dad has gotten virus on his laptop, and I fixed it.

[@renalyncericos6070]

@@NatK2010 worst case is that i installed a virus on my laptop and my dad. Got the belt faster than light long story short i had to. Fix it myself

[@nikolan123]

Same lol

[@lololol502]

My dad using computer: *Downloading random stuff* Me after running antivirus: *6397 threats detected*

[@CubingBones]

My computer is slow after dad uses it so i have to restart the computer everytime but there are no viruses detected :)

[@veliozkan2943]

spy ware among us m8

[@linux_fox]

this is why you educate your folks

[@WillDoesTech]

@@veliozkan2943 LOL

[@yt.rafapvp]

Lmao

[@32Celsius]

My guessing was that malwarebytes will detect like 500 but it blew my mind to see it go to 3000+ instantly

[@itsTyrion]

keep in mind that every file is a detection (so if something has 50 files, that can be 50 detections from 1 virus) and MB detects A LOT of things as malicious or PUP. Not always in a good sense :D

[@mr_confuse]

@@itsTyrion it has been trying to quarantine my BitTorrent for years now lmao

[@eleventy-seven]

@@mr_confuse Make a exception. It will then ignore it.

[@eleventy-seven]

​@@itsTyrionYou can set it to ignore PUPs.

[@Vex22778]

​@@mr_confuseit does the same thing with any other torrent software I don't know why but anyone that I use I always have to exclude it

[@Vilematrix]

I worked at a IT company and one standard everyday job was cleaning the pc's of coworkers. On average there was 52 payloads found a day on 1 pc. Sometimes a MITB ( man in the browser ). They really should install a firewall or managed policy rules.

[@filipoda123]

please tell me it wasnt some big company at least 💀💀

[@Vilematrix]

@@filipoda123 well, its a mid range company with multiple locations and they are part of a company group. They handle websites of local business and webshops. And transfer medical information. So you understand i grow a little cynical over those years after i adressed it multiple times.

[@filipoda123]

@@Vilematrix damn, a mitb in a website company lol

[@Vilematrix]

@@filipoda123 i know right. Xd

[@NormalHumanLikeYou]

@@Vilematrix how does a man fit in the browser

[@antonioniemy5897]

MalwareBytes could use this video as an ad for themselves with how much it did.

[@aseldesu]

Uninstall Tool too

[@x2v9]

@uNnHkP8mza what's mbam

[@tantivy1321]

true, this video was the trigger for me to install it

[@afterskool444]

LOL true!!! i remember spending so long back-and-forth with a windows technician (god bless them) who told me 'yeah install the malwarebytes free trial it does way more than windows defender pretends that it does'

[@MidnighttArtz]

@looped_gameing8406 nobodys perfect but the little guys trying his best

[@ryan20028]

Worth noting that connecting an infected machine like this to wifi can be rather risky. Some malware will try to spread to other connected devices in the network.

[@-_-_-_-_-_-_-_-_-_-_-_-_-_-ucq]

Probably using an alternative wifi router with a different ISP?

[@naphy]

​@@-_-_-_-_-_-_-_-_-_-_-_-_-_-ucqor just mobile hotspot...

[@Noob-ye3hs]

I always had a mindset that if my pc got infected, then even though it may not be able to be removed from inside, the good old hammer could do a great job from the outside lmao

[@masteryxl]

Lmao

[@Biggerman159]

And G U N

[@thelegacyofgaming2928]

And fire

[@avtips4779]

Maybe a cold pill

[@SneakyLittleHobbit]

I have yet to meet a virus that can survive my water attacks.

[@j.w.techchannel]

That is some impressive work. I'm actually surprised by how close the system is back to it's original state.. Though it's still obviously ideal to reinstall Windows to ensure there's no malware left over whatsoever.

[@sihamhamda47]

Also some specific malware could infect the BIOS chip in the motherboard and still remains intact after fresh install (the option to remove BIOS malware is desolder the infected BIOS chip and replacing the BIOS chip with the good, uninfected one)

[@FtE1]

@@sihamhamda47 no you can do something to old bios chip and remove compeletly everything and reinstall upgraded bios

[@sihamhamda47]

@@FtE1 Ah yes, re-flash BIOS can also fix that

[@FtE1]

@@sihamhamda47 but i rather put new bios chip

[@Gokul_Yt]

@@sihamhamda47 refalsh bios is an option. some motherboars and laptops come with a flash usb port some times there is a symbol/ or refer manual

[@its_an_inkstar]

Him putting all the viruses on that one Toshiba hard drive felt like containing The Radiance inside The Hollow Knight. Unfortunately that means that the viruses will break free. Be prepared. Be afraid.

[@ThumperMinerUnion]

I'd be more afraid if it grew legs!

[@its_an_inkstar]

@@ThumperMinerUnion it'll grow more than just legs

[@ThumperMinerUnion]

@@its_an_inkstar can't forget the Cable Scorpion

[@peeboo]

That hard drive might become sentient

[@its_an_inkstar]

@@peeboo might?

[@sangitachakraborty2465]

One of the greatest videos I have ever seen. The turi ip ip is an example of imagery in sound. It's delicacy astonished me. It just changed my mind about Enderman. Turi ip ip never dies. It is immortal, inevitable and one of the greatest objects of all time.

[@PantherGD_]

🥹

[@x2v9]

Just stop making tur ip a "funny" music

[@synexiasaturnds727yearsago7]

@@x2v9 you will not stop your fellow 12 year olds, it's an impossibility

[@puppergump4117]

I had to turn my volume down to 3% to watch this

[@mrrfyW_]

I like how the chat went crazy when Symbolism played

[@gamecuber6]

i agree

[@disgoodplays]

@@catwazhere no

[@disgoodplays]

I like the song without the meme

[@TELEK1NET1C]

turi ip ip

[@CosminCrihan]

Great job! I use Kaspersky Rescue Disc for a job like this myself, it is just easier because it boots in a clean environment to work with while disinfecting.

[@thepyro7845]

I have no idea why, but hearing “tori ip ip ip” just felt so out of place after all the memes, and i just started laughing from it

[@derpboxstudios]

Still better than skibidi toilet

[@frodo4503]

Really liked video :) some suggestions towards next videos about virus removal from me would be: -using proces explorer with virustotal column added to have a closer view if anything harmfull is still running -throwaway pendrive: you can invest little money to get a pendrive with mechanical switch that put pendrive in read mode only. I use one of this all the time as i work as IT technical repairing at local computer store. -for uninstalling programs i recommend revo uninstaller - free tool which allows to select multiple programs and uninstall them + after uninstall it scans for leftover files and registry from app so its more deep cleanup after reinstall my top infected computer i had from customer had 27000+ threats found in malwarebytes (some were ofc from same malware as malwarebytes count every file and registry as new threat)

[@frodo4503]

after uninstall* typo

[@Albertfanmailblog59383]

Uhhhh..... Yeah good luck with that... 27000+THREATS!!??

[@frodo4503]

@@Albertfanmailblog59383 yup reinstall wasn't an option because of specific program with database which i needed to backup. Removed as many as i can so i can barely open and backup database then reinstall with no mercy. Niezła jazda xD

[@SoMiSongbird]

Holy SHITE 27k+? That's crazy

[@doomslayerobama]

Holy crap, this computer is the digital version of a pitri dish.

[@CS_Uravity_PRO]

I usually do this with my friends and family's computers. I ALWAYS try to go for the remdy/Clean up option first. I like trying to fix every issue possible without having to reinstall Windows all over (and possibly deal with backing up a ton of shit). And it honestly feels rewarding when you see the result.. Great vid!

[@thehoodedman4271]

Never thought in my life that I would watch a malware cleanup video by an Enderman. …The Internet's a magical place, huh?

[@LOLMAN9538]

Yeah, even if you removed all surface malware, you would probably still have concerns about deep-rooted malware on the HDD. I would just say "forget it" and do a fresh reinstall of Windows. It seems to be the best option.

[@thelegacyofgaming2928]

I would just throw the computer away. It's finished.

[@georgeofhamilton]

@@eleanorbartle5354 That’s a really cool concept.

[@rayzojams]

@@eleanorbartle5354 if androids ever become real it's gonna be the flu or covid for them lol, or the black plague

[@codyryan9789]

​@@georgeofhamiltonmagnet

[@georgeofhamilton]

It looks like @eleanorbartle5354’s comment is hidden now, but she basically had an idea of a form of infectious malware that could even spread through physical contact between digital storage devices even while they are turned off, necessitating careful disposal in special facilities.

[@overlordeggy]

enderman: empty for 2 weeks also enderman: 2 uploads in one day

[@FloresdorfGaming]

These results and logs could be very useful for antivirus companies. Pherhaps one that this hard work will be noticed.

[@LinusTechT1ps]

i would love to see the malware 10 partition myself, but i understand if you are concerned if ppl that don't know about this stuff can get infected themselves, amazing job!

[@Reycko]

alt title: enderman shows how good he is at repairing computers. Why did antivirus companies not e-mail you yet

[@Shiga06]

The Symbolism song as you try to delete malware is just 👌

[@opsonc]

nah its not symbolism its turi ip ip

[@bwalimniad]

@@opsonc dead meme

[@derpboxstudios]

@@bwalimniad still better than skibidi toilet

[@IBI12]

You can even see the amount of space changing from the amount of junk being deleted from the rainmeter plugin

[@KOSMOS1701A]

i like how when you first started, the ram use was like 6gb of out of 8 and removing all that trash brought it down to 2gb.

[@Alberos]

If it's this bad I will for sure reinstall and burn the whole thing down but very nice restore and satisfy to watch! My coworker once got a ransomware (just one), I told him to "NUKE THE WHOLE THING". You never know what "free stuff" you will get from a single infection. Today it's all nasty thing, keylogger, info stealer so on and so on, better to be safe.

[@dusklunistheumbreon]

With a single infection, it's fairly safe to assume you can fix it. You *will* need to research the virus to figure out exactly how it works, but it's possible to fully scrub a machine of it. When you install over six THOUSAND viruses from random sources, that becomes significantly harder and exponentially more time consuming. You go from a task that'll take a day or two to something that'll take a *lifetime* or two.

[@dusklunistheumbreon]

That being said, if it's on a company computer instead of a home computer, I absolutely would not spend even a minute trying to salvage it lmao.

[@Mannard74]

Malwarebytes and Tdsskiller do most of the heavy lifting.. but in cases like this I would absolutely suggest a 100% clean wipe (after backing up anything worth saving, of course)

[@Surg-265]

petri*

[@sihamhamda47]

2:05 Thanks for giving me an info about a free disk cloning software, because when I'm looking for any disk cloning tutorial, most of the tutorials forced me to use either Minitool Partition Wizard or EaseUS To Do Backup, which are now forcing its users to use a subscription service just to use the disk cloning feature

[@sldlelmo2]

ChatGPT's Title: "Reviving a Malware-Infested Nightmare: Restoring the Unusable Machine"

[@qyclops]

good job enderman! you're like my dad once, i broke my pc (automatic repair couldnt work) but then he fixed it. great job!

[@Sploo256]

how i see my computer 12:18 how my parents see my computer: 3:00

[@AyoCrunchy]

Watching this is like watching those rug cleaning videos, it's so satisfying seeing the clean finished product

[@theairispure4314]

It took *almost 1 hour* for Malwarebytes just to quarantine all of the 6,397 threats.

[@Fearagen]

You did a good job of returning back to its original state but if it were me, I would get put a Windows 11 or 10 iso on an USB and do a complete format and reinstall windows. Never know if there is hidden stuff or if the malware infected critical system files that if the antivirus removes it'll bork something, had it happen before.

[@getthepartystarted1247]

I would use a Windows 7 iso instead.

[@Fearagen]

@@getthepartystarted1247 That OS is pretty much deprecated in 2023. Same state as Windows XP little software support and modern gaming is out of the question. Also hello guy that archived ampdan1's videos, appreciate your dedication.

[@getthepartystarted1247]

@@Fearagen Oh hi, it's you!

[@jhunalfi]

infected with turi ip ip ip

[@knur-soft]

I wonder what was the worst case of malware infection in history, intentional or not. There should be a guiness record for this.

[@siliconsulfide8]

I think it might not be a great idea if it'd make people want to install many viruses just for the record.

[@grimagikoopa]

my grandma:

[@theliteralcow]

3:00 I died of tears when the turip ip ip ip ip ip ip turip

[@kissel2010]

while humans are 70 percent water, this computer is 100 percent viruses)

[@erenoz2910]

damn those viruses were fighting hard over cpu time

[@jarPlays11]

We need this guy to be at tech support.

[@LandonEmma]

3:04 TURIP IP IP!

[@Balaaj1217]

The fact he has the best gaming setup ever. And also the Turi ip music in the bg during the fixing

[@i7bwn]

don't forget to first go into the option of alwarebyte once you installed it and enable COMPLETE scan for better findings.

[@0xC4aE1e5]

For sharing the whole image Terabox might work, not to mention in Macrium Reflect you can also change the compression level.

[@uruhaiP]

That infected startup also reminds me kinda of my old laptop I had until 2022. I remember trying to use the innate Record feature in Roblox to make a video on Become Fumo back when I had that laptop and I'm not kidding when I say that it crashed my _entire computer._

[@ChakkyCharizard]

When I was 12, I had a laptop that would lag emulating Gameboy games.

[@NotEvenJokingg]

I like how the music synced with the Malwarebytes pro ad popup slider thing

[@michaelstechnology]

I just saw a new Michael MJD video, and now there is an Enderman video in the same day!? Yes please!

[@saudistic]

the $5 windows 98 pc

[@flyicestormpluto]

Seeing the disk space avaiable go up was so satisfying!

[@refurbishedaudio4090]

@Enderman I heard you could still get infected if you install certain malware on a virtual machine as it will transfer to the host machine

[@Soup69God]

Very very rare that will happen as long as your virtual machine software is fully updated, and you turn off certain features that allow for connectivity between the vm and host. No networking, no shared folders, etc. You'll still run into issues with malware that can detect its in a VM and refuse to run, so you need to use virtualbox with the vbox hardened loader.

[@GalaxyTheReal]

Can happen when installing advanced malware and if there is a security thread in the hypervisor youre using

[@gameplayallgamesresidmon184]

It is only very very rare if The Virtual machine is a Packed Vdi/Vhd/Vmdk File

[@tauon_]

that's impossible, the most it could do is insert itself into a shared folder

[@kokojack]

​@@tauon_ Virtual machine escaping is possible through the use of technical exploits but those exploits are usually not found in common malware

[@sanghatan7526]

this is almost the same as my old laptop before. when it boots up it just randomly open apps and as a child, i just close everything and call it a day

[@josheco4]

the effort that went into this is crazy

[@TheRealIzzyPlayz]

So helpful! Thanks Enderman! Best one yet

[@mmwish9051]

The two 5 year old Flintstones gummies in my system when I get an illness

[@SmellyGum]

Me vs free minecraft 2018 updated:

[@Theinatoriinator]

I would also do a windows defender online and offline scan, they are pretty good at grabbing stuff.

[@cupcakescupcakegd8880]

What happened to your profile picture it's close up the top left

[@Maxim67459]

Pov: What I was feeling when I was deleting miner on my pc

[@dotxyn]

Love the music you select for your videos

[@charginginprogresss]

10:50 It's not that it couldn't. It's that malware and adware are two different beasts.

[@atsizbalik]

windows 10 according to linux users:

[@hmroid6884]

Windows 10 according to Windows users:

[@atsizbalik]

@@hmroid6884 no, more like "Windows 10/11 according to Windows 7 users"

[@hmroid6884]

@@atsizbalik I don't consider w11 a operating system it's just corporate endorsed spyware+

[@olympiaalkisbarmagiann7859]

Thanks for motivating me to fix a virus in one of my old laptops

[@PhilXavierSierraJones]

Nice touch on the selection of the music 🎶

[@Beef1188]

The boot time still isn't equal to the time before the infeciton, which means the cancer did some damage or it wasn't removed completely.

[@Maks7594]

about 1% of the icons on the desktop are not malware (bluestacks, game center)

[@bigsof7381]

And VMware

[@superNova5837]

I think he at some point he uninstalled google chrome and had to reinstall it

[@osc-omb47896]

Either he just went rampaging downloading everything and a couple things were innocent, or they're trojans

[@olivesouch6423]

2:50 Grandpa: "AHHHH! TOO APPS! OH MY GOODNESS, THIS IS TOO MUCH!"

[@aseldesu]

sure, reinstalling windows is the better choice, but this is a really good way of going about it if theres important data on the computer, at least to make its retrieval easier

[@Azaelris]

there isnt any guarantee your important files aren't infected, best to comb through them to see if theyre really clean.

[@kimxgamer]

Btw how do you get the C drive storage and task manager graph widgets on the desktop?

[@NathanDarkson984]

You know, now I wonder that this would probably be some kid's actual computer somewhere around the world...I'd imagine how they would have so much patience to even use it since there's a lot of shit going on lol

[@emi4860]

This was so entertaining and informative too !

[@LivingHunter]

Nice Video bro and good work!

[@Elroorl666]

Step 1. Replace harddrive

[@mix3k818]

Holy crap. 6,000 threats. Yeah, at that point formatting would've been the best option

[@MJ-uk6lu]

Before that dban or other equivalent scrubbing. And still I wouldn't be 100% sure that HDD doesn't have FW level malware.

[@enzoduvernay4540]

I've a nice tool to recommend, it's called Hitman Pro and is like AdwCleaner, I think it would've been a nice touch to try scanning the infected machine with it

[@_colonial_]

IDK if it's just me, but I can't remember the last time I heard of someone actually disinfecting a system. If something gets past Defender/MalwareBytes/whatever, everyone I know would just go straight to "nuke and restore from backup." Granted, having backups makes you more tech-savvy than 95% of the population, so maybe there's bias there...

[@reginangel_official]

this is the final boss for computer engineers

[@thisfeatureisbad]

2 videos in a single day??? 🥰

[@Havii]

I really enjoyed this video. Thank you 💕💕

[@Vlame]

I use Macrium Reflect as well. It takes a while but you have a complete clone of your hard drive

[@-hypernova-]

him: cleans PC also him : *proceeds to play legendary songs*

[@ipadize]

at this point, i would just buy a whole new computer

[@succojones]

I wonder if a decked out powerful pc would be able to handle all of that malware crap and still be usable. That would be funny to see

[@mr.m2675]

I think there are videos about that even an amazing pc can be dragged to its knees, think about it more power more cripto mining

[@OakBlox]

3:00 we all got turi ip-ip-ipd by enderman 😂

[@reporterecho6000]

pov: grandma bought a computer to use facebook

[@lookbehindyou2794]

The fact is this is the worst pc that got infected alot You repair good! Your the best tech guy or something I've been watching you since 2019

[@TallEdge90]

Ha I have even worse pc than that I had a acer computer infected it had celeron cpu it wouldn’t boot up

[@sta5011]

@@TallEdge90 Lol same I even got a script virus from shitty ads that turns on my cpu too which is impressive

[@HarmonicaMustang]

I'm a sysadmin, and I definitely take reimaging for granted. Malware? Reimage. Broken updates? Reimage. BSOD? Reimage. It saves a lot of time on needless troubleshooting when you can just get the PC back to a known working and stable build in less than an hour.

[@euphoricvoyage]

>Was named fast >Actually slowed down the computer

[@Lychu]

"I honestly didn't expect it to succeed that bad" got me ghhaahhahahha

[@gniusz934]

Everybody gangsta till turi ip ip

[@Damariobros]

How well would a Windows Defender offline cleaning done in lieu of that initial Safe Mode offline malwarebytes scan? The one where it reboots into an offline self-contained instance and scrubs the whole drive? How many instances would it catch?

[@Kleinshooti]

You know this is class when turi ip ip ip plays in the background

[@rukirgaming]

Kinda wanted to see how well Microsoft Defender would handle it

[@GERALD_786]

still more repairable than my oldest laptop

[@thatoneweirdkidfromschoolt9521]

I have noticed that Windows defender or Malwarebytes is able to catch malware that Norton would say your computer is clean

[@TheMotorhead30]

yes, because norton is premium garbage and should be avoided. it was good when it was first launched but has become adware you subscribe to at this point.

[@matheuscordeiro653]

TURIP IP IP IP, nice work bro

[@TomRoso]

3:00 my ears: hmm i hear that song before. my brain: TURI IP IP IP

[@derpboxstudios]

Still better than skibidi toilet

[@lieutenantwoomy3146]

bro hit me with the turi ip ip

[@pumaroar1]

This was a great premiere!

[@vueling102]

Pov PC: Why are bullying me? Me: Experiments son...