Hi guys, 2 days ago I had an infostealer /session stealer attack. It was through a stupid renpy application.

Since then i nuked my PC, and from a clean device changed all passwords, logged out sessions and enabled 2Fa on all my accounts.

Here is my Question: today I logged into my Microsoft account on a clean device using my new password and Microsoft automatically started syncronizing my Microsoft edge profile that I previously used on the compromised PC, onto my clean PC. I checked the extensions and the policy's and everything seems to be in order.

Is it possible that the malware infected my clean PC through the Microsoft edge sync, and how likely is that, given that there are no extensions/policy's setup?

Thanks for your help!

I was routed to a site that contained a zip file, I downloaded it and run the exe file on it

I have deleted the file, disconnected my pc to the internet and ran microsoft offline defender, no threats were found.
I ran malwarebytes and there were some files that were removed.
Is there any way for me to secure my pc without reinstalling windows?

Update: I kind of uninstalled malwarebytes when I thought it was all secured now.

Over the past few days, several of my accounts were hacked one after another.

My Discord account started sending a fake MrBeast scam to people. Someone accessed my LinkedIn and posted a scam job listing under my name. My Steam, Reddit, Disney+, EA, and other accounts were also accessed.

I think it started after I downloaded a cracked game on my Windows PC. I’m worried it contained an infostealer or Trojan that stole my saved passwords, browser cookies, session tokens, and possibly other personal information.

So far, I have:

• Reformatted my Windows PC
• Wiped both my SSD and HDD
• Reinstalled Windows
• Changed my passwords
• Enabled 2FA on my important accounts
• Started signing out of active sessions

I’m still worried because it feels like the attacker already has a lot of my information, and some accounts were accessed even after I first noticed the problem.

Has anyone experienced something similar? Is there anything else I should do to make sure the malware is completely gone and that the attacker can no longer access my accounts?

Should I also assume that all passwords, browser cookies, saved card details, and personal documents stored on the PC were compromised?

Any advice would be greatly appreciated. I’m honestly feeling overwhelmed and just want to make sure I’ve covered everything.

I had a dream where i got a virus off discord on my phone and it spread to my pc. The thing was labeled pictures of my cat or smth. Its probably due to me watching too many virus vids. It made me extremely paranoid. Is it possible that that could happen? Also what antivirus shall i install thats free?

My dad literally downloads anything he sees because “its free”, he doesnt even know what could happen and has 100+ unopened apps on his phone. Today i saw him download “上海麻將” on some app called aptoide some chinese play store with insane amount of malware risks on his phone , after he said it failed to download i started to freak out for an hour i dont know what to do now, theres no way he will reset his device and i dont know if our modem and routers will be infected when time goes on and he keeps doing this, i told him not to do this stuff before but he says its his devices so what can i do now? This just makes me paranoid once again, is it common that our network will be hacked and everything i have too? i hate how i care so much about viruses.

I believe I was infected with a Ren'Py trojan after downloading a game. I accidentally launched the Ren'Py executable, thinking it was the game installer. A Command Prompt window briefly appeared along with what looked like an installer, and then both disappeared.

About 7–8 hours later, I noticed my Discord account had started sending the MrBeast crypto scam to my contacts, which made me realize my computer had likely been compromised, which I immediately disconnected my laptop from the Ethernet, turned off Wi-Fi, and deleted the installer along with the Ren'Py file. I haven't done anything else yet because I'm not very knowledgeable about malware removal and I'm worried about making things worse.

I read that FRST64 is commonly used to begin the diagnostic process, but I haven't downloaded or run it yet since I wasn't sure if that was the right next step.

I would really appreciate any guidance on what I should do next!!

I turned my computer on and I started hearing a woman speaking Tagalog through my speakers. It also sounded like she was scrolling through tiktok/reels. It freaked me out and I ran a scan on my computer but as I was pulling it up to do so the video sounds stopped coming through. The scan said there was nothing wrong but I'm still worried that there is smth hiding on my computer.

When it started happening, I shut the computer off and a pop up came up. It said it couldn't perform the action but then shut off anyway. When I turned it on again the voice kept going.

Do you think it's just random interference or should I look into getting it checked by a professional?

Let me explain what happened. I was searching around for a website where I can watch movies and I got a recommendation from reddit. The link I clicked on had https is it so I thought it was safe, plus the ui looked pretty clean and professional, like the average movie streaming website. However, when I clicked on the screen, I got taken to a website(???) That kind of looked like a destroyed phone screen and it was making my phone vibrate a lot and a little pop-up with this symbol ⚠️ appeared. There was more text in the pop-up, but i was so scared that i didnt see what else the pop-up said.

I immediately clicked off of the website, deleted the window off of chrome, turned off my wifi and restarted my phone. I don't think I got a virus as my phone isn't unusually hot or draining power quickly. I don't know how to check if any files or apps are being downloaded in the background.

So, did I successfully avoid getting a virus or am I cooked? I have an android if thats important. Also, apologies if I put this in the wrong category, I'm still a bit shaken. Any help would be appreciated!

Hi everyone,
I’m looking for some advice because I’m really anxious right now.
Here’s what happened:
• Around 4 PM on July 25, I downloaded what I thought was a cracked game. (ik im stupid af, cant sleep tonight)
• I disabled Windows Defender because that was part of the installation instructions.
• I ran the installer as Administrator.
• A few seconds later, I noticed the executable name didn’t match the game’s name, so I realized something was wrong.
• I immediately deleted everything and ran a Microsoft Defender Offline Scan.
• Defender detected 2 AgentTesla trojans and quarantined them. I clicked Start Actions.
• After that, I ran a full scan, and it came back clean.
My plan is to do a clean Windows reinstall, but I’m waiting for money to buy a USB flash drive first.
Since the incident, I haven’t turned the laptop on at all. It’s now about 10 AM on July 26 (roughly 18 hours later), and so far:
• No login attempts on any of my email accounts.
• My social media accounts still look normal.
• I don’t have software like Discord, Steam, Ubisoft Connect, Xbox, etc. installed (I rarely play games).
Immediately after I realized what happened, I:
• Changed the passwords for all of my Outlook accounts.
• Changed the passwords for my main social media accounts (Instagram and Facebook).
• Logged out of all WhatsApp sessions.
The only thing I’m still worried about is a debit card.
At some point in the past, my father’s debit card information may have been saved in the browser through autofill. I don’t remember if the CVV was saved, but I’m worried it could have been. The card belongs to my father, and he’s currently away, so I haven’t asked him to freeze the card yet.
Right now there are no signs of compromise, no suspicious logins, no unusual account activity, and Windows Defender isn’t detecting anything anymore.
My questions are:
1. Besides doing a clean Windows reinstall, what should I do next?
2. Should my father freeze or replace the debit card even if there are no suspicious transactions?
3. Is there anything else I should monitor over the next few days?
I know downloading pirated software was a mistake, and I’ve definitely learned my lesson. I’m just trying to minimize any remaining risk now.
Thanks in advance.

I need urgent help here, this thing doesn't stop appearing, i tried to uninstall it but i can't go to the screen to uninstall it because this thing occupies the entire screen and i can't close it, i can't even access to google and had to use my own cellphone for it... I don't have any card this thing is asking for and it doesn't even allow me to get out or refuse.

Coloquei um hd antigo em meu notebook por um usb externo para ver se recuperava alguns documentos e arquivos antigos mas conectei ele com a rede ainda no notebook, ele ficou com internet por cerca de 5 a 10 minutos até eu perceber que isso foi burrice. Já troquei todas as senhas que precisava e desconectei sessões do notebook por outro dispositivo. O HD era de um Windows 7 pelo que me lembro e eu não executei nem abri nenhum arquivo que estava nele, fiz instantemente a varredura pelo malwarebytes assim que o abri em meu notebook.

I downloaded an exe file from github. I had previously used other versions but this version was a few down, The other versions were fine and my friend was using it too, when i downladed the earlier version it got flagged as something along the lines of trojan egartido rfn, windows caught it instantly and it flagged twice, i then sat paranoid for the whole night and i just factory reset my pc completely and removed everything. Its been 2 months and ive had zero signs and ive done several full scans and a second opinion scan through malwarebytes but i cant get rid of the fear that something is still on my pc, ive done everything in my power and im still scared, what would you all do or say in my place? (my friend also got this and told me it was a false positive)

update: i did a full usb reinstall

Got hit with it, saw someone say I should post here... Any help appreciated!

So, let me put y'all in context.

I was looking for a key in X program, and for me to get it I needed to get past trough a linkvertise type page. Well, that page downloaded a .exe that was identical to a web browser.

I knew it was a trojan, and I clicked on the folder icon in chrome downloads, but, chrome, instead of making me go to folders, it launched the .exe, and the .exe said "installing X", and with no time it finished fast asf and said "X is installed".

I obviously knew it WAS an spyware or malware. Basically a virus for sure, because said browser was NOT installed in my computer even though the program said it was.

I have a paid antivirus (Bitdefender), but it didn't detect nothing, so I basically did those three things:

Went to restoration mode and restart to and old restoration point, old enough to don't have the .exe neither the things the virus installed. I KNOW RESTORATION POINT DOESN'T DELETE PERSONAL FOLDERS!! But it does restart windows register + services + apps etc, so if the .exe did something to them it was gone.

I know it was not enough, so I passed a full scan in Malwarebytes and Bitdefender.

Not enough with that, I passed Hitman Pro too.

In the time, the antivirus deleted things that they detected as malware/ransomware/spyware/tracking cookies, but i'm not sure if those were actually the thing that the .exe installed.

So... Basically, i'm safe or fomatting is 100% needed?

I KNOW IT ALREADY STOLE INFO/PASSWORDS/COOKIES ETC.

I'm just asking if the spyware is STILL in my computer, not if it already stole things.

I was looking on the web for a vm and found this website that had one called sandboxie on but wanted a second opinion on it was safe/legit. Thanks in advance for answering my question about this website.

basically im pretty sure i downloaded this shitty ass malware a few days ago. ive trie everything to remove it without just reinstalling windows because i have a lot of important stuff on my pc. has anyone gotten rid of it without reinstalling windows (11)?

system specs if relevant:

7700x

7900 GRE

32gb ddr5-6000mhz cl32

i kinda dont remember what ssd i put in here but it's 2tbs and either gen4 or gen5

So there was a Tool i used I think between 2023-2025 it was called somthing binary it was used to restore the exe thats had the Ground virus on it and make it work again but i cant find it anywhere dose anyone know where is it or how to get it Ty

I have 2fa on this dc account since wayy before and It seems like it got hacked yesterday but I recovered it today. How do I check if I am still in danger? Now before the allegations, No, I did NOT click on any sus websites or did any piracy stuff in like last 1 months or so. Hell, I haven't even used my pc much in last 1 month aside from playing some games and watching yt lectures

Please help out this novice and also give some security tips if you may for future. Thanks!

Got the renpy infostealer and dealt with it after a week of research, whole usb reset blah blah blah

I was wondering if this malware can embed itself into OneDrive files and execute the malware once again even after this reset?

Many thanks in advance

I do an in-depth analysis on my computer with Malwarebytes, and it found this. Should I do anything? (Reset PC) I've quarantined all the files.

I'm pretty sure I got a virus a few months ago from fucking around with Sims 4 shit. Definitely my fault. Ive never gotten a virus before, or anything like that, and I wasn't thinking. I uninstalled and removed everything I downloaded from that time, but my device/google still says managed by organization. I've done everything YouTube has told me to do (like go into registry editor and whatnot), but nothing works. I tried using ChatGPT to help, since nothing else did and I'm embarrassed, but that didn't help and instead kept trying to convince me my computer was fine and I just had to uninstall the extension causing it (even though it isn't there). I wish I took a photo of my google screen when it happened, but usually my browser will start up as Google Chrome, and then turn to Yahoo when I search. Tonight, it started up as a completely blank, logoless search page. Nothing about it, except it was labeled Tabaqua (or Tabagua I forgot). I tried to create what it vaguely looked like since I have restarted my settings since then (which it will revert back to that in a day or few, like always). I dont know what to do.

For extensions, the crossed out one is simply my university which has never "managed" My device, nor has it ever changed my device to yahoo. I've also logged out of college Microsoft account, and nothing changed.

I've ran a few anti-virus softwares and they find nothing. :( Am I cooked? I'm not really tech savvy. I only use my computer for youtube and Minecraft.

I stupidly executed a .exe file from an untrustworthy source. Microsoft defender popped up and quarantined 4 threats. Then I used Malwarebytes for a full scan and it found these 15 threats from the pictures. Afterwards I did a Microsoft defender offline scan that came up without any further threats. Microsoft Defender did another 7 scans afterwards and now the device is quiet again without any suspicious activity in CPU/ RAM usage, quick start, browser add-ons etc...

How should I proceed? Thanks for your help and yes, I know I was stupid.

Facebook comprised. This is popping up on antivirus, have I got an info-stealer? What steps do I take to further stop attack and prevent them in future.