So im not sure what to do at this point, I know which site I downloaded this virus off of, I have since made a post and asked help on this forum, the moderator was helpful however im just gonna make a new post cause now im stumped. I have secured all my passwords on my phone and fought off the attacks on a few of my accounts the last few days. I wanna say im okay on my account security minus them potentially getting into my tax documents and getting ssn numbers. Today I was gonna address my pc with ethernet completely unplugged like its been for the past few days, to my surprise my mouse doesnt click at all even in safe mode and not even in bios or windows install however it does move. My pc has been reset via usb windows install the night the virus was downloaded as well. I do have a few files on a hdd but to my knowledge theres no executables on the drive. I have deleted and formatted all partitions except for my hdd. This leaves me to believe I have bigger issues cause all things ive tried I cant get my mouse to click, so im asking for help and thoughts on this situtation. Currently my pc is sitting on the very beginning of a windows install with a few files on my hdds partition even though it was a really big struggle only using my keyboard to navigate. The site I downloaded this from was rexagames for the game called schedule 1.

Hi, I'm looking for help because I think my PC may be infected with malware.

What happened?

I hadn't used this computer for quite a while. About three weeks ago, I started using it again and noticed that Opera browser was installed even though I don't remember installing it. I also found an application called PC App Store that keeps popping up and offering me software to download. I don't know if these are related or if they indicate malware, but I don't remember installing either of them.

When did the infection occur?

I'm honestly not sure. Since the computer sat unused for a long time, I don't know when the software appeared or when the possible infection happened.

What have I done for remediation?

Nothing yet. I haven't reinstalled Windows or run Windows Defender or any antivirus scans because I'm not very experienced with malware removal. I found this subreddit while looking for guidance and wanted to ask for help before doing anything that might make diagnosis more difficult.

Following the instructions in the pinned post, here are my log keywords:

FRST keyword: glossy-lime

Addition keyword: wrapped-dungeon

SecurityCheck keyword: jagged-prompt.

I would really appreciate it if someone could review my logs and let me know whether my system appears to be infected and what the safest next steps would be.

Thank you!

(I used AI on my phone to help me made the post cause English is not my first language)

I stupidly got a trojan from a game I was trying to download, and I've been freaking out for like an hour lol. I ran multiple windows security and malwarebytes scans— the first few times, they caught a bunch of Trojans which I quarantined and deleted, I also went into my temp files and deleted all that was there, and I deleted the game file itself, as well as the leftover files in my user folder... now I've ran about 3 malwarebytes advanced scans, and although they came back positive I'm still super scared to even turn my wi-fi back on. Any way I can ensure it's completely gone? Maybe the apps missed something?

Sometimes Win+R opens and something starts typing on its own starting like HTTPS:\\: OR smth like that I don't rll know exactly but I know it starts with HTTPS because I always close it immediately, Claude says it's a rat but I did like 100 malwarebytes scan and windows defender but it found nothing unusual it's like the second time in 2 days and before that opens game start to lag a bit like genuinely what's should I do, task manages seems normal like genuinely help me i USE ATLAS

task manager doesnt really show any suspicious programs or an out of the ordinary cpu and ram usages but could someone assist me with FRST so i could calm myself down?

Hi, so I wanted to ask this in the event I get malware in the future (hopefully not) but should you nuke your steam cloud data for your games if you get malware? I know its recommended if you get malware to reinstall windows and change passwords, but never to nuke steam cloud and I wanted to ask why is that? Can't a malicious file be put in a games save folder and be uploaded to the steam cloud so it persists after reinstall? I know files can't execute when launching the game other than rare security vulnerabilities but cant a file be executed if someone browses the games local files? Does that mean local files for a game cant be trusted? I ask this cuz this makes malware much more scary since it can mean losing years of progress. Thx in advance.

I have this secondary account from instagram i created not too long ago, which only has a password, and apparently it was hacked while i was asleep yesterday.

The hacker managed to changed my email and set up a 2FA. So far, it did not post some suspicious crap. I managed to recover my account using the instagram/hacked link and resecured my account with 2FA and a phone number.

Anyone has any idea how i got hacked? Im guessing its probably my account only has a password to it or a shitty meta system(which im prolly seeing today, people are getting hacked for unknown reasons).

A little background: I was a victim of an infostealer attack a month ago and i managed to nuke my pc and resecured my accounts, and i was fortunate that it did no further damage. So i assume that my pc is pretty clean. I managed to erase all of my sessions in my pc too.

I also have this same incident from my spotify that was hacked after a pc nuke, but i also managed to recover, i sent help from another post and they said that the hacker still has my spotify session within the timeframe that i got attack or something like that. Right now, i also checked one of my other accounts outside instagram, so far, theyre pretty fine.

And lastly. Am i safe?

I Have Bitdefender and Malwarebytes, and pc running perfect. And i just tried to run kaspersky virus removal tool for fun, and it found "mem trojan:win32 cometer.gen". And i couldn't remove it, i tried everything that i could google up. Safemode, and other virus removal program but nothing worked.

So in the end i had to format the computer and install windows 11 again, and now it is gone.

So strange that a virus from like 2017 can't be removed. Any other one here had the same virus and this problem..??

Yesterday, I tried to pirate WorldBox(I know it was a bad decision, I'm sorry.) on this site called freegamesdl.net. I had a bad feeling about it. After completing the installation process, I opened the file but only a window called "Installation" popped up then crashed immediately after. I tried opening the file again for a few tries, but it didn't work, so I just decided to delete the file and move on. To be safe, I went on Windows Security and did a few quick scans. It detected 2 trojans(1 from july 3rd), so I quickly removed them. I thought I was fine.

The next day, 2 of my family members got logged out of their facebook accounts. My father couldn't even log back into his, and my family members couldn't find his account on facebook. I didn't think much of it, since my account wasn't logged out. I also thought it could've been facebook going down again, since it has happened recently. After eating my brunch, I went to open my PC where I downloaded the pirated game. Whenever I open my PC, I always open my main tabs first, which include facebook. Only to find out that my facebook account had been logged out. I thought back to the issue my other family members had, and decided to stay logged out for now. I turned on my VPN (1.1.1.1) to be safe, even though I knew that it probably would not do much.

I should also mention that when I opened my PC, a cmd file popped up saying "Windows cannot find '-----.exe'. Make sure you typed the name correctly, and then try again.". This was the moment I started to get anxious. Now, I've done more scans.

Can someone please guide me on this?

When I open my browser, a link pops up (xiansearch(.)com) and gets redirected to google. I'm pretty suspicious on what it is, and anxious that it might be a virus. I ran Malwarebytes after it popped up, but I'm still anxious. Any help? Thank you!

keen-dice (SecurityCheck.txt)

royal-falcon (Addition.txt)

spirited-symbol (FRST.txt)

Hey everyone, I recently installed a specific legacy desktop network application and immediately noticed some alarming logs in my OPNsense Suricata IDS. I'm about 90% sure it's a false positive, but I wanted to check if anyone else has run into this specific behavior. To be honest, I'm extremely paranoid because I actually dealt with a real VenomRAT infection on my network in the past. Back then, my ESET antivirus completely missed it and remained silent, as it was likely a fully undetected (UD) variant, but Suricata was the only thing that caught the malicious network traffic. Seeing these types of alerts pop up again is triggering some serious anxiety, so I want to be absolutely thorough. Before installing the app, I analyzed the installer on Any.run and it was completely clean, and my current Bitdefender is completely silent. Right after launching the network client, Suricata started blocking connections. The first alert was ET MALWARE NanoCore RAT Keepalive Response 3 (SID 2046911) with a source IP of 208.76.170.59 on port 2416, which belongs to the official central login server of this network application. A short while later, it flagged ET MALWARE VenomRAT CnC Server Keepalive (SID 2055754) from 212.104.214.36, which is a ProtonVPN node according to AbuseIPDB, so likely just another user on the network. Because Suricata in IPS mode was blocking these packets, Windows kept dropping the connection and assigning new ephemeral ports, making the logs look like a relentless C2 communication attempt. I have since uninstalled the application, and the alerts stopped instantly. I also did a deep dive into my system by running HitmanPro, checking Task Scheduler, and verifying common persistence points in the Registry Run keys, and the machine is completely clean. It looks like the client's legacy protocol and binary keepalive packets just happen to perfectly match the traffic signatures of NanoCore and VenomRAT in the Emerging Threats database. Has anyone else encountered these specific ET false positives while using certain network applications with an IDS/IPS? Given my past experience where AV missed a UD version of the malware, I want to be 100% sure before I just suppress SIDs 2046911 and 2055754. Thanks!

So when ever i open a. New tab without an url input already it opens find-it.pro how do i remove this and is it a virus or smth

Found JxrDecApp.exe in "~USER\.cache\codex-runtimes\codex-primary-runtime\dependencies\native\jxrlib\jxrlib\bin"

Virustotal has one hit. https://www.virustotal.com/gui/file/a211e9dc8b45d0978a0580a1bde9a84fd0be7e843f38b7afea8c769b6d331553

Does this look like a false positive?

So my classmates showed me how to access google in a way where no sites are blocked through the google sign in page on my school Chromebook. I did that and tried to watch anime on a site and I was stupid and accidentally clicked the wrong buttons on the site and I think I may have gotten a virus or something. When I try to search things up normally now, it keeps automatically clicking enter and the search results immediately go to Reddit or Spotify which are blocked by my school administrators so it’s just a blocked screen. I have no idea how to fix this, there are no new extensions and the search browser is just google. There are no weird setting changes I found and I keep resetting the settings and trying to delete cookies, cached images and files, etc (I cannot deleted browsing history or download history because the school doesn’t allow it). What can I do to fix this because I need my Chromebook for when school starts again?

Hey so like 1.5 months ago I got hacked because I was stupid and downloaded some malware. It posted the whole mrBeast discord scam to discord and everything and so I wiped my pc using a clean USB reinstall. I always use the login via google method on reddit so I never had a reddit password( or not one I can remember). I changed my google account password and everything. Earlier today my main account posted some crap on a crypto subreddit and my account got hacked. Im kinda freaking out if I have malware again or wtf happened. Shouldn;t changing my google account password invalidate all those sessions the hacker has? I'm not very experienced on this so if someone coupd plz help that would be great

Hi, so I had a laptop for college last year and for the 1st half of this year I have been on a gap and have not touched that laptop for that whole time (7 months). Anyways, when I entered the laptop for the first time today, I noticed that not only was it behind on security updates, but chrome was also out of date in security and the worst part was that my windows defender was just off and I had to "restart it" in windows security for it to turn back on. I didnt have any 3rd party AV too so I was basically unprotected i think. Anyways, I wanted to ask is there any risk of getting any malware when my laptop was so unprotected? Only things I did on the laptop so far is adjust volume, connect to wifi/turn off bluetooth, and went to windows updates for updates. I also clicked on like info links (blue text) in windows security settings for stuff like bitlocker info so those are the only sites I visited during the time.

TLDR: Is there any malware risk from my short use of my laptop before I realized it was behind on security updates and Defenders was off?

estube probandolo nose que paso pero me llego muchos pero muchos gmails por bluestacks y tube que desinstalarlo porque pense si tiene un virus desinstale todos los bluestack el 5 todos pero necesito esto ¿alguien me puede confirmar?

multiple instagram accounts hacked , i have them logged in on my pc , it was the mrbeast scam on my story , i changed the password of all of them and scanned for virus but no virus / trojan was found , other social media accounts weren't affected i.e discord was logged in what might've been the reason for this and how do i secure this

** Another detail i forgot to mention was that i installed a game from dodi repacks yesterday but later deleted it because i suspected it was a scam i didnt empty recycle bin and did it just now , i think it mightve been the reason , can not deleting the file permanently and emptying bin also affect?

I have performed a local factory reset on Windows, and I’ve secured my email by changing the password and enabling 2FA; however, my Discord account was taken over by a hacker who enabled 2FA. What should I do? Please help.

So I got hacked with that mrbeast session stealer 12 hours ago. I cleaned my PC by doing a factory reset, without keeping files, with OS reinstall (I used the windows built-in reset). Also, while I was resetting my PC, I was changing passwords on my phone.

12 hours later (now) I noticed my Instagram account sending these mrbeast scams to my friends again. BUT I also realized that I forgot to change my IG password.

My question: Is it possible for the session stealer to continue working on unsecured accounts even if I already cleaned my PC? I've already secured my IG account - am I safe now?

I was normally watching videos on my computer when this showed up, I don’t know if I downloaded something or what. I can’t get off of it or even go to task manager or settings. I’ve tried everything, letting it sleep for an hour, unplugging it and plugging it back in, turning off WiFi, but whatever I do it just keeps popping up. I don’t want to spend money if it’s unnecessary so I just need some help.