The trouble started the next morning.
For the next hour, he played digital detective. He ran Malwarebytes, HitmanPro, and a rootkit scanner. Nothing. The file idm64_ai_helper.exe was digitally signed—but with a certificate issued to a company called "Bridgeware Solutions S.A.," not Tonec, the makers of IDM. He opened the file in a hex editor. Sandwiched between the normal IDM code was a block of encrypted data. At the very end, in plain text, was a signature: // Compiled with love for Taiwebs community. Build 6.41.2 – The Watcher. idm taiwebs
He opened Chrome. His bookmarks were gone. In their place was a single, neatly organized folder named: Things you will never watch . The trouble started the next morning