r/computerviruses • u/Arbiter3740 • Aug 10 '26
Question Random Installer on PC
This random installer setup window popped up, what is this!?
Edit: Thanks to [u/AvailableDirtForSale](u/AvailableDirtForSale), I think I’ve narrowed it down to the Opera Browser. A while back, Opera was acting weird and installing a random extension. I tried to delete Opera, but it wouldn’t let me. I eventually figured it out and deleted it, but unfortunately just now I found the Opera folder in “C:/Users/Username/AppData/Local/Programs/Opera”.
This also seems to be tied to Advanced Installer
I can’t seem to delete it, it says I need admin rights even though I am admin. If anybody has any suggestions, please share them 🙏
15
u/AvailableDirtForSale Aug 10 '26
From the googling I've done. There is no official software by this name, it is most certainly malware. You need to close this via task manager. Boot into safemode and see if you can figure out what the installer is and what program it can be attached to.
12
u/Next-Profession-7495 Aug 11 '26
Doesn't look like this is a known application. Try searching for something like TheUpperLevelx7.msi or something related on your PC. Upload it to VirusTotal if possible.
5
10
u/KneeSensitive Aug 11 '26
If you kids keep installing various "mods"this is what happens....the file path quoted Roblox
9
u/m0thgh0st Aug 11 '26
Judging from the apps on the desktop, this kid is a wannabe hacker that installs any and every "tool" he finds online without any actual understanding of how they work. I wouldn't be surprised if there is more than this on the machine.
1
u/Arbiter3740 Aug 11 '26
Also, please don’t judge people just on what apps they have. You have no idea what I use this stuff for, and who knows if I’m even a “kid”.
-4
u/Arbiter3740 Aug 11 '26 edited Aug 11 '26
I do know what I am doing, and I am very knowledgeable on the subject. Although I’m not surprised that I have a virus 😅, I do try to avoid them. I only download what I need for the task to be done
2
u/Ecstatic-Ball7018 Aug 12 '26
what the hell are you doing with qFlipper and iloader then?
1
u/Arbiter3740 Aug 13 '26
Using my Flipper Zero and sideloading apps my to iphone????
1
u/Ecstatic-Ball7018 Aug 13 '26
why the hell do you have a flipper zero unless you're a qualified pentester or a script kiddy
2
u/m0thgh0st Aug 13 '26
IMO, flipper zero is almost exclusively for script kiddies. I'm a network engineer and pen tester and nearly all of my work is done across linux desktop, esp-32 (captive portal attacks phishing with those mostly), and rpis of verious versions. Pen testers are developing their own tools and attack methods, not downloading github scripts.
1
0
2
u/Epinephrine186 Aug 13 '26
Dawg, if you asking for anti virus help, youre not very knowledgeable lmao
1
2
u/Arbiter3740 Aug 11 '26
I do not own Roblox, I have not downloaded it, and I don’t even play it!! It’s something else… 🧐
3
u/waspenterprises__ Aug 13 '26
The UI you are seeing is a MSI installer created with AdvancedInstaller, which can also be configured to silently install smth (see hxxps://www.advancedinstaller(dot)com/silent-install-exe-msi-applications(dot)html)
I would assume that this UI being shown is a mistake by the creator of this potential malware, and that this UpperLevel thingy was intended to be installed without you noticing. As far as I understand, the source of this should be an .msi file, and if you didn't start the installer yourself, there has to be some code that did it by using the msiexec command. I might be wrong here (please correct me if I am), but searching your system for any scripts and binaries that use the msiexec command should narrow down the source of this.
1
u/Arbiter3740 Aug 13 '26
Wow thank you! This is a lot of useful info, I’m on it
1
u/Apprehensive-Pop3736 Aug 17 '26
Did you find the file and delete it? If so has this shown up again?
1
6
u/Bitdefender_ Official Bitdefender Aug 11 '26
Hi! In order to manually remove an infected file from your computer, you need to perform the steps below. We recommend manually deleting an infected file only if you are sure the file isn’t an important operating system file:
- Restart the computer in Safe Mode. You can do that, by following the steps in our article, here.
- Display hidden objects in Windows. Information on how to display the hidden object can be found here.
- Locate and delete the infected file: right-click on the file and then select Delete in the menu.
- After you do this, you can restart the computer normally.
2
u/Arbiter3740 Aug 10 '26
I’m also scared if it’s an app I have that this is running through, like wallpaper engine or something
1
1
0
u/Puzzled-Ad3136 Aug 11 '26
WE is a good call here, try to uninstall it, not the first time WE gives u malware
5
u/Anxious-Ad8026 Aug 11 '26
It's just adware something else prolly installed it for a commission that would be the original virus it's why it doesn't pop up just look for some other stuff and do DM me it could be you installed maybe cheat engine or smt
1
1
u/Icy_Pain5654 Aug 11 '26
That name isn't a legit publisher I recognize and it just appearing on its own is the red flag.
1
1
u/epicsakuyalover Aug 12 '26
Sorry this comment won't help at all. This is at least the fifth post I've seen about the same installer. There definitely has to be a connection among all of these.
No shaming alright? Did you pirate any software lately? Or installed any not-so-known brand hardware like a keyboard or a mouse with its own drivers setup?
1
u/Arbiter3740 Aug 13 '26
Hmmmm I haven’t installed any suspicious drives. I usually use hshop on my DS for the games, so I haven’t done that from my pc
1
u/epicsakuyalover Aug 13 '26
Any software you've installed from its official website? The last time I saw this the OP was saying they got Voicemod from the official site and then this installer popped out after that.
1
1
u/troncrash7 Aug 12 '26
What's the last thing you downloaded/installed before this? Knowing where this is from could help
1
u/309_Electronics Aug 12 '26
Did you download some sketchy stuff like roblox/fortnite hacks or random tools? If then, yeah thats probably malware .....
1
1
u/PsychonixMimikyu Aug 10 '26
Not sure, if I was in your situation id see if maybe I have anything of that name in my downloads and delete it. If there's nothing, then id run a scan with windows defender full scan. And if nothing then, id do a full scan with malwarebytes.
1
u/EarEfficient9500 Aug 11 '26
Idk if this helps, but on the installer from Nefarius HidHide driver is the exact same installer with that picture. And since i see some software for controller on the desktop i could assume it would be possible that is has something to do with that
2
u/waspenterprises__ Aug 13 '26
The installer itself (AdvancedInstaller) seems to be valid, the problem is what it's installing
1
u/Arbiter3740 Aug 11 '26
Hmmm ok that does help, I’ll look into it
0
u/AvailableDirtForSale Aug 12 '26
https://howtoremove.guide/remove-theupperlevelx7/ found this, brand new article posted 12 hours ago.
1
1
33
u/Timely_Branch799 Aug 10 '26
That exact thing popped up for me too! Windows defender doesn't find anything and the deep scan is still running. But I can't open the Bitdefender website and the installer i let my friend send me isnt working either!! I have unplugged my wifi for now and the deep scan is running but idk what to do next.