WA-ZIP Cleaner

English | Bahasa Melayu

Someone sent you a zip file on WhatsApp (for example Click here to view....zip, Notice.zip, PDF_C2841_20260911100446.zip, 20261019-MYS2026Y1019E51AC.zip or 101.zip), and you opened it on a Windows laptop or PC? Stay calm. This free tool scans your PC, and if the malware is there, it removes it.

If you opened it on a phone (Android, iPhone) or a Mac, you are safe. This malware only attacks Windows.

One catch: if your phone auto-saves the file to Google Drive (or another cloud drive), and your PC syncs with that same drive, the file lands on the PC. If anyone double-clicks it there, the PC is infected.

Is this really malware?

Yes, this is not a guess. We uploaded the file to two websites whose job is checking malware. Both say it is dangerous:

VirusTotal: 18 antivirus engines flag it as malicious	Hatching Triage: score 10/10

The malware is called ValleyRAT (also known as Winos 4.0 or Silver Fox). Once it is on a PC, the attacker can steal your passwords, switch off your antivirus, and control the PC remotely as if they were sitting in front of it.

Step 1: Run a Windows Defender full scan

Defender is the antivirus that already comes with Windows. Nothing to download.

1. Press the Start button (Windows logo, bottom left of the screen).
2. Type Windows Security. When it appears, click it.
3. Click Virus & threat protection (shield icon).
4. Click Scan options (blue text under the Quick scan button).
5. Choose Full scan, then click Scan now.
6. Wait. Usually 30 minutes to 2 hours. You can keep using the PC while it runs.
7. If Defender finds anything, click Start actions or Remove.

Step 2: Scan with this tool (copy and paste one line)

Defender does not always catch this malware, because it uses legitimate programs to fool antivirus. The October version even tells Defender to ignore it, so a scan looks clean when it is not. This tool looks for the traces of this specific WhatsApp malware, including that "ignore" setting, and removes them all.

Be careful: some attackers trick victims into pasting commands into PowerShell to install malware. Do not paste commands from people you do not know. The command below only fetches files from this project's official GitHub (waz.afuit.dev redirects straight to the run.ps1 file in this repo), and the code is open for anyone to check. If in doubt, show this page to an IT person you trust and ask them to do it for you.

A. Open an admin window

1. On the keyboard, hold the Windows key (Windows logo), then press X. A menu opens at the bottom left.
2. In that menu, click Terminal (Admin). On Windows 10 it is called Windows PowerShell (Admin).
3. A box asks "Do you want to allow this app to make changes to your device?". Click Yes.
4. A black or blue window opens with some text and a blinking cursor. This is where you paste the command.

B. Paste the command

1. Press the copy button at the right end of the box below (or highlight all the text in the box and press Ctrl + C):

irm waz.afuit.dev | iex

[Net.ServicePointManager]::SecurityProtocol="Tls12"; $p="$env:TEMP\waz.ps1"; iwr https://raw.githubusercontent.com/afu-it/wa-zip-cleaner/main/wa-zip-cleaner.ps1 -OutFile $p; powershell -ExecutionPolicy Bypass -File $p; if ($LASTEXITCODE -eq 1 -and (Read-Host "Taip Y dan Enter untuk bersihkan") -eq "Y") { powershell -ExecutionPolicy Bypass -File $p -Fix }

1. Click once inside the black/blue window. Press Ctrl + V (or right-click) to paste.
2. Press Enter.

The tool talks in Malay first, with the English version in grey right below each line.

C. Answer the question

1. The tool asks: is this PC/laptop managed by your office, or your own?
   • A PC/laptop your office gave you, managed by an IT team: type 1, press Enter.
   • Your own PC/laptop: type 2, press Enter.
   • Not sure: just press Enter.
2. The scan starts. Wait 2 to 10 minutes. Do not close the window. You will see eight rows, [1/8] to [8/8], each ending in a coloured label.

D. Read the result

1. Look at the KEPUTUSAN (RESULT) section at the bottom:

   • BERSIH (green, means CLEAN): the tool did not find this malware. You can close the window.
   • AMARAN only (yellow, means WARNING): the tool removes nothing. Read the yellow text and follow its advice. If it mentions ManageEngine and this is an office PC, show the screen to your office IT. If it mentions a Remote-control program (for example AnyDesk, TeamViewer) that you never installed, remove that program (see Programs that cannot be uninstalled below).
   • BAHAYA (red, means DANGER): at the very bottom you see Taip Y dan Enter untuk bersihkan (type Y and Enter to clean). Type Y, press Enter, go to step 11. Chrome, Edge or other browsers close by themselves, because the tool logs WhatsApp Web out on this PC. Open them again when it is done (if you are reading this guide in a browser, reopen this page).

2. Wait until you see Kuarantin siap (quarantine done). Bad files are not deleted outright. The tool moves them to C:\WAZipQuarantine, so anything removed by mistake can be restored. The tool then asks Nak hantar laporan? (send a report?). It is your choice. Type Y to send us the list of what was found and the scan log, so we can study the attackers and improve the tool. Account names, PC name, emails, phone numbers and network addresses are removed first, and your documents are not sent. Just press Enter to send nothing. If there is no internet, the report is saved on the Desktop and you can send it on Telegram to @afwazan.

   If the tool quarantined malware, it asks one more question: Hantar fail virus untuk dianalisis? (send the malware files for analysis?). Type Y to send the quarantined malware program files (for example .exe, .dll, .sys, .dat, VHD) to our server. The server keeps them in a password-protected zip and checks them on VirusTotal; malware VirusTotal has not seen yet is uploaded there, so other antivirus programs learn to catch it. Documents, pictures, zip/rar files, and anything from Downloads, Desktop or Documents are never sent. Just press Enter to send nothing.

3. Restart the PC (Start > Power > Restart).

4. When the PC is back on, do Step 2 again from the start, until it shows BERSIH.

Missed the Y question?

If you pressed Enter without typing Y, the tool removed nothing. Do not type y on its own; PowerShell will not understand it. Paste this line into the same window and press Enter:

powershell -ExecutionPolicy Bypass -File $env:TEMP\waz.ps1 -Fix

The tool says "Windows would not let the tool remove" or "ManageEngine is NOT fully removed"?

Some ManageEngine parts (for example MEARWService) protect themselves. While Windows is running, even an admin cannot remove them, even after a restart. So we remove them while Windows is not running. No need to reinstall Windows.

After you type Y, the tool asks you to pick:

• Type 1 (automatic Safe Mode, recommended): the PC restarts into Safe Mode, the tool removes everything, then restarts into normal Windows. Do not touch anything. Only type your Windows account password (not PIN) when Safe Mode asks.

If Safe Mode is not enough (the tool tells you), follow these blue recovery screen steps:

1. Before the restart, take a photo of the red text with your phone.
2. On the blue screen, click Troubleshoot > Advanced options > Command Prompt.
3. If asked, pick your account and enter the PC password. If it asks for a BitLocker recovery key, open account.microsoft.com/devices/recoverykey on your phone.
4. In the black window, type this and press Enter:

   C:\WAZipQuarantine\BUANG.bat
   

   If you get not recognized, try D:\WAZipQuarantine\BUANG.bat.
5. Wait until you see SIAP (done). It lists what it switched off (Dimatikan), moved (Dialih) and deleted (Dibuang). Everything is backed up first to C:\WAZipQuarantine\winre.
6. Type exit, press Enter, choose Continue.
7. Once Windows is up, do Step 2 again from the start, type Y, until it shows BERSIH.

Want to do it yourself without waiting for the tool to ask? Go to Settings > System > Recovery > Advanced startup > Restart now, then start from step 2 above. The BUANG.bat file only exists after the tool has tried to clean (you typed Y) and was blocked.

If the PC gets stuck in Safe Mode after choosing 1: open the blue recovery screen (steps 2 and 3 above), type bcdedit /deletevalue {default} safeboot, press Enter, then exit > Continue.

BERSIH does not prove the PC is safe. The attacker can change this malware at any time, and this tool only knows the versions we have taken apart. If you really did open the file on a PC, still do the password steps below. If in doubt, ask an IT person to check.

If you opened the file on a PC, also do this

This malware can sit quietly on a PC for weeks while stealing data. So even if the tool shows BERSIH or has removed it, assume your passwords have leaked.

Use your phone, not the infected PC:

1. WhatsApp > Linked devices > log out all. This stops the attacker from using your WhatsApp to send the bad file to your friends.
2. Change the password of every account you ever logged into or saved in Chrome or Edge on that PC. Start with online banking, email, Google, Microsoft and Facebook.
3. In each of those accounts, log out all other devices and turn on 2FA (a verification code from your phone).
4. If there was bank information on the PC, call your bank and ask them to watch your account.

Then, for the PC:

1. Restart the PC, then do Step 2 again until it shows BERSIH.
2. If the tool warned about ManageEngine (and your office never installed it), or found a driver that switches off antivirus, the safest way: back up only your important files (documents, photos), then reinstall Windows. If you are not sure how, take it to a computer shop and say the PC was infected with remote-access malware.
3. When backing up, do not copy .exe, .zip, .dll, .bat, .vhd or .vhdx files. Only copy files you recognise.

If you never opened the file on a PC, and this tool shows BERSIH, you do not need to do any of this.

Cleaned the PC (or reinstalled Windows), but WhatsApp still sends the file by itself?

This is not because the PC is still infected. While the malware was on the PC, the attacker stole the login keys (sessions) for WhatsApp Web, Gmail and other accounts from the browser. Those keys are now in the attacker's hands, not on your PC. That is why reinstalling Windows or deleting cookies on your own PC does not help. The attacker can still use the keys they copied. They have to be shut off from the account side.

Do this in order, using your phone:

1. Log out every Linked device. WhatsApp > three dots (Android) or Settings (iPhone) > Linked devices. Tap each device > Log out. Do it for all of them, including the ones you recognise.
2. Turn on Two-step verification. WhatsApp > Settings > Account > Two-step verification > Turn on. Set a 6-digit PIN the attacker cannot guess. This stops the attacker registering your number on their phone.
3. Shut Gmail off from the Google side. If your passwords were saved in Google (Google Password Manager), the attacker may have all of them. Open myaccount.google.com > Security > Your devices > sign out every device you do not use. Then change your Google password and turn on 2-Step Verification.
4. Change the passwords saved in Google or Chrome, starting with banking and email. In each account, look for Log out all sessions or Sign out everywhere.
5. Do not link WhatsApp Web again on any PC until that PC shows BERSIH with this tool.

If one WhatsApp number is used on several PCs (common in shops or offices), scan every one of those PCs. One infected PC is enough for the attacker to steal the session.

If you did all of this and WhatsApp still sends the bad file: the last resort is to delete the WhatsApp account and register again with the same number. All old sessions are gone for good. The cost is that your chats, groups and settings are lost, so back up important chats and contacts first, and tell customers or friends you re-registered. How: WhatsApp > Settings > Account > Delete account, then reinstall WhatsApp and register with the same number.

WhatsApp number banned?

This malware sends the file to every contact and group at once. WhatsApp sees that as spam, so the victim's number often gets banned (a message says the account is not allowed to use WhatsApp). If that happens:

1. Clean the PC first with this tool until it shows BERSIH. Otherwise, once the account is reopened, it spams again and gets banned again.
2. Open WhatsApp on your phone. On the ban screen, tap Request a review (or Support).
3. Write briefly: your account was hacked by malware from a WhatsApp zip file, you did not send those messages, and the PC has been cleaned.
4. Wait for WhatsApp to reply. Usually a few hours to a few days. Do not send the review many times.
5. Meanwhile, tell customers and friends by SMS, phone call or social media: do not open zip files from your number.

Once the account is reopened, do steps 1 to 5 above straight away (log out Linked devices, turn on Two-step verification).

Antivirus says "clean", but something still feels wrong?

Regular antivirus, Malwarebytes and VirusTotal often miss this malware. MyCERT itself says a regular antivirus scan does not remove the remote-control program (ManageEngine) the attacker installs. So a "clean" result from antivirus is not enough. Use this tool, and if you are still unsure, reinstall Windows.

Other signs the PC is infected: the PC freezes for a minute after opening the file, the file cannot be deleted because it is "still running", or WhatsApp starts sending zips by itself two or three days later.

Report to MyCERT (Cyber999, Malaysia): email [email protected], phone 1-300-88-2999, or +60 19 266 5850 (24 hours). Include a screenshot of the message, the time it arrived, and the sender's number. Reference: MyCERT MA-1464.062026.

More information below. Click a title to open it.

I think my Windows PC is infected with the WhatsApp "Click here to view.zip"
malware (Winos 4.0 / Silver Fox / ValleyRAT). I am not good with IT.

There is a free tool to remove this malware: https://github.com/afu-it/wa-zip-cleaner

Please teach me one step at a time, in simple language, how to:
1. Run that tool on Windows the easiest way.
2. Understand what BERSIH (clean) and BAHAYA (danger) mean.
3. Remove the malware if it is there.
4. What I must do afterwards (WhatsApp Linked devices, change passwords).

Do not tell me to reinstall Windows first. Ask one question at a time if needed.

powershell -ExecutionPolicy Bypass -File .\wa-zip-cleaner.ps1        # scan only
powershell -ExecutionPolicy Bypass -File .\wa-zip-cleaner.ps1 -Fix   # quarantine
powershell -ExecutionPolicy Bypass -File .\wa-zip-cleaner.ps1 -Owner Personal -Fix   # personal PC: ManageEngine counts as HIGH and is removed
powershell -ExecutionPolicy Bypass -File .\wa-zip-cleaner.ps1 -Owner Office         # office PC: ManageEngine is only a warning
powershell -ExecutionPolicy Bypass -File .\wa-zip-cleaner.ps1 -RemoveManageEngine   # force-remove ManageEngine without asking
powershell -ExecutionPolicy Bypass -File .\wa-zip-cleaner.ps1 -Restore -Manifest "C:\WAZipQuarantine\<date>\manifest.json"

Licence

MIT. Free, but with no warranty. Use at your own risk.