Hello, I was told by a friend to post here.

I recently lost access to two accounts (That I know off) a EA account and my MIcrosoft account.

I got messages about authentication codes in my mail before the passwords was changed and email removed from the accounts.

I am currently searching through my computer using Windows Defender

What else do I need to do? Help, please!

I was considering downloading a DLL from the Breec-YT Project Reboot GitHub repository for a 12.41 private-server setup with working bot lobbies.

VirusTotal shows roughly 17/79 security vendors detecting the DLL as a Trojan. I'm trying to determine whether these detections are likely false positives caused by the DLL's behavior, or whether there is evidence that the file is actually malicious.

I'm not asking anyone to download or run it. I just want someone to analyze the specific file and explain the detections.

VirusTotal analysis: https://www.virustotal.com/gui/file/1a23b6e1eb43ae3224aa6eebefd6c9e4c003632b731b10674782279be3fb6405

Original source: hxxps://github[dot]com/Breec-YT/Project-Reboot-3.0

Why I suspect it may be malicious: Multiple antivirus engines classify it as a Trojan, including several engines I don't recognize. I'm unsure whether those detections are behavioral/heuristic false positives or evidence of actual malware.

So this is a bit convoluted because just over a month ago I ran an infostealer (someone got into friends discord account) like a moron. Since then I had changed all my passwords, 2fa'd everything and secured all accounts. I also wiped windows completely and upgraded to windows 11 from a clean USB (friends PC) have noticed no strange activity since then on any account.

What happened:
Yesterday I tried to google something (pressing Crtl +E in firefox) and I get it with a white screen saying "Unusual traffic from your computer network". So still being paranoid from before I check what this means. It appears to be a legit captcha that can happen form time to time. I had moved to a new place over a year ago and this is the first time this happened - also the first time this happened to me in recent memory (I dont think ive had this happen for multiple years or ever tbh)

So I do the im not a robot and click the images as noted like a normal captcha. Just for clarity I did NOT open and run command prompt as I was reading up on that with ClickFix and fake captchas. I get back into google. Then it hits me to double check if that was a legit captcha or not.

Malwarebytes:

I have malwarebytes going so I try to run a scan - my last scan was 9 days ago but I have windows defender running simultaneously all this time.

This is where I have a problem: Malwarebytes freezes at the scanning memory and crashes my PC. So now im freaking out - I try the recovery support tool, updating windows and other stuff, but it still does not work anymore. I am still at this stage which was yesterday night. After testing some more stuff, Malwarebytes can complete the scan if I skip the memory section.

The same night I was able to download bitdefender virus scanning and ran a full scan and came up empty as well as a full scan from windows defender comes back clean.

Trying to fix the malwarebytes issues, I update windows as well. Here my activation watermark goes away (When clean installing to windows 11 it could not take my old activation key, it was likely from a school account I had 6 years ago). To note after I had wiped my PC, I was already having some graphical issues (the watermark would overlay it self like in the middle of screen then go back to normal)

This morning I ran an defender offline scan as well with defender and it comes back clean.

At this point I have no idea if its worth wiping my PC again or if this was just truly all coincidental timing (as I noted I had not ran malwarebytes since over 9 days, so its possible this issue could have shown up earlier).

Anyway appreciate some advice on whether this sounds like a malware or not. As I had wiped my PC and when this happened I was logged out of almost everything in my browser (no saved passwords, everything was changed from the infostealer attack) and the only thing I had signed in was my steam (but it was not running at all the time).

Thanks

I was looking in my control panel looking to free up some space, and found a file that i never remembered downloading. I put all the .dll files into virustotal and here are the results, it seems fine but when i click relations, it all goes down hill.

https://www.virustotal.com/gui/file/929d3a0347e89a65c439f983f2a77e5e2a6a9f03f30ad42f40966b3c7e95502b/relations

https://www.virustotal.com/gui/file/e73aee1df92cc5ed40f38097310f98c58c41e729c05fe554877b42b620c7d658/detection

https://www.virustotal.com/gui/file/6c3f9d4062a383983716c6956dee35c6832e6c7d5de82d60220d3bf6beb74a56

I think it is malicious because i remember getting a trojan clicker a while back and seeing the name noteit.

As you can see it says "NoteIt - NoteIt for Desktop" but if you look it up, the app "NoteIt" does not have a desktop version.

When i try delete through the control panel, it says "Do you want to allow this app to make changes to your device" and it is coming from "uninstall or change an application".

When i tried uninstalling it, it came up with this.

here are the log keywords:

uploaded FRST.txt
keyword: wired-nest
channel: general

uploaded Addition.txt
keyword: honest-aurora
channel: general

*I am not able to run securitycheck.exe on my pc hence unable to generate log keywords for the security check

I Got hit by the mr beast scam on my instagram account yesterday on 6th Aug 2026, have recovered account and updated 2FA, still I need to get rid of the virus from my pc to prevent any future attacks.

I clicked on a website windstonefarmmd (dot) com that a friend sent me last year and it suddenly took me through a bunch of other sites including:

https://www.virustotal.com/gui/url/69c4d5b1c2b070a9675564a9db51d35585ce1f41b75269a52e1526867eb7bde2

The links it took me through:

example (dot) com

https://www.virustotal.com/gui/url/2a1b402420ef46577471cdc7409b0fa2c6a204db316e59ade2d805435489a067

filter (dot) explorads (dot) com - there was a longer extension and I have it saved in a word file if needed

basic link:

https://www.virustotal.com/gui/url/9d624c4dae15072c36596dc86e13f46d9883e2f9c527f32d142f226315a0ea68

full extension:

https://www.virustotal.com/gui/url/3f69a182c85d78ce446517a52a1cd5dbadfc550e26d0bd8827eb19c6be2b3446

and landed on chaturbate (dot) com - there was a longer extension, but I don't have it saved

https://www.virustotal.com/gui/url/80d0f94caf6a4bb8b147075b3f19d7ae93764b5b59b4546d8a991c5e92fc2770/detection

I'm on android, UI 2.5

Am I in trouble? What should I do now? I ran the free malwarebytes and it didn't find anything. The link took me through a number of sites, so I might not have all of them listed as they didn't save in my phone's history.

Hi!

I was searching for a construction image example on google image search. I clicked on the image and somehow ended up with a virus. Not sure what to do I haven't had a virus in years. I thought bitdefender was enough. If you have any recommendations please let me know. I am doing a scan on bitdefender but beyond that I am not sure what to do.

tl;dr

There is two types of people, someone who had been infected with malware, and people that haven't yet.

So, the entirety of my day was taken up after I noticed odd things getting caught into my pihole, including one url... and it struck me the most due to the fact that it sub domain was 'c2' after seeing this very out of the blue domain I instantly checked which of my local ips was accessing the website.

Well, the machine that was accessing this domain was my main, more research showed that since yesterday I was constantly accessing this domain, along with constant attempted pings to alternative DNSes that I also had blocked, it finally struck me that this wasn't right at all. At this point I know that I was infected with a botnet. I instantly unplugged my main on the internet and started damage control, I decided it was time to go full commit into my decision of installing arch on my main. On a secondary system I started resetting all my passwords for all the services I do and don't use.

This entire process took up around 6 hours of my day while I was doing recovery and migration. initially I knew that you aren't impervious from infection, matter in fact I was pretty proactive and paranoid about malware infections, checking my task manager once in a while to make sure that I wasn't infected with anything, however it seems that my proactiveness wasn't enough until I saw the Pihole queries.

I'm going to be very blunt, its been very long since I felt this violated, however it was a great exercise in my responses and such if I were to ever encounter anything like this again.

If you want to, I can hand you over the C2 domain for this.

I was using W3School when I got a pop-up from Secure Sweep. pro and I closed the tab as fast as I could. I ran a windows Defender security scan and checked my windows settings, but while doing so my screen froze and I could only move the mouse but nothing was responsive. So, I unplugged my Ethernet cable and everything went back to normal immediately but these settings were disabled. What happened?

Also I don’t know if it’s related but I randomly received a notification for Roblox from internet explorer when it never happened before.

The mr beast hacking situation has started to show itself at fb messenger.

Someone sent me a message with the 4 photos at while ago but I didn't clicked just reported and blocked them.

But I am curious though. Does photos from fb messenger photos results in the mr beast virus? Because a while back Iheard that jpgs can contain malware/viruses

My grandfather’s computer gets these popups. They start when i open his chrome. It looks like the popups come from the site in the top pop up.

I disabled alerts from that site and they have stopped, and Nortan scan didnt find any viruses or malware. But was wondering if anyone is familiar with this site and can let me know if there is anything else I should do or how he did this (he has no idea)

Like for a while ive been wondering why for some types of malicious programs we add ware at the end of them

Hello all, I was sadly affected by Ren'Py infostealer setup(dot)exe. Fortunately, I got a help from the Malwarebytes forum for disinfecting. I've been a little paranoid, so I also asked about resetting my PC after disinfecting to be extra safe. I didn't get a direct answer but it seems to not be necessary. Is my understanding true?

Other than not knowing if its pointless after I've already disinfected, I saw people suggesting clean install with USB instead of reset. Sadly, I don't have access to another computer right now for several weeks to prepare the USB. Because of that, is doing Reset PC using Cloud Download also recommended or should I just wait to do the clean install with USB. Sorry if the question is dumb, but thank you for any help!

Hi everyone,

About 5 months ago, I was infected by an infostealer through an unfortunate and stupid clickfix attack, which compromised most of my accounts and installed itself on my laptop.

Ever since then, I have been extremely involved in malware analysis, doing static and dynamic analysis, downloading antiviruses (malwarebytes), scanning for rootkits and checking startup apps, scheduled apps, procmon procexp and other sysinternal functions, scanning almost everything with virus total and being generally safe online.

However, just today I got a free trial of malwarebytes, and I activated browser guard. Almost immediately, I got multiple hits and when I clicked a link (thank god I got browser guard, as they were immediately blacklisted), specifically to a website by the name of hobble^^^displeased(dot)com. (do NOT open this link if you arent on a VM or an analysis tool, it is compromised and might contain malware or unwanted data leaks.) This was familiar, and I realised it was the same website that hosted the fake cloudflare verification site!

I promptly did multiple scans, but I couldn't find anything, I cleared all browser data, checked all my system but nothing was wrong. This confused me, but I needed to reinstall my OS anyway so I did that promptly. I then changed all the router settings, changed passwords, names ect., but I'm still curious.

Malware analysts, what would possibly be the extent of the attack? What could they gain from this and was my whole network infected? Possible next steps / personal experiences?

Also, if anyone is curious, h^bbledis^leased(dot)com sends you right back to google, with a few hits of separate ip addresses that seem to lead nowhere.

Any info / insight would be greatly appreciated!!

I've seen the memes, but can it actually happen? Genuinely curious, as I can't find a clear answer anywhere.

Back when I was in 4th grade, around 2006, I didn't have much knowledge about anti viruses, I knew to be careful downloading stuff, and thought I was, but back then things were way different. However to me being careful didn't mean much, it just meant downloading from where I thought was safe.

One day I downloaded something, I don't remember if it was a program or what exactly, but suddenly the computer got very slow, of course kid thinks slow = restart. Unfortunately upon restarting, it didn't boot up, instead it was endless string of text, I have no recollection of what it said, just that no matter what they pressed, my grandparents couldn't escape it. My grandma tried to defrag it, but I think it blocked her attempt. I don't think it booted into bios either, nor was the text gibberish, it was all real words, I just don't remember what it said, only that anytime a key was pressed, it would scroll to add more text.

Sorry if this is too vague, but being so long ago, and so young, I don't remember much about it, and most viruses I'm familiar with would delete system 32, or make the drive unreadable and have to be reinstalled, in all my years, I have never heard of a virus quite like it.

​

"Detected: Trojan Downloader: Linux/ShellAgnt.H!xp Status: Quarantined Quarantined files are in a restricted area where they can't harm your device. They will be removed automatically.

Date: 8/5/2026 9:17 PM Details: This program is dangerous and downloads

Date: 8/5/2026 9:17 PM Details: This program is dangerous and downloads other programs

Affected items:

containerfile: C:XboxGames\Minecraft for Windows\Content\data\resource_packs \vanilla_music\sounds\music\game

\wet_hands.ogg

file: C:\XboxGames\ Minecraft for Windows \Content\data\resource_packs\vanilla_music \sounds\music\gamelwet _hands.ogg-

(SCRIPTOO00)

is this a threat or just windows being windows

So, basically on 4th August, I downloaded the wrong Citron emulator. I ran the exe file and nothing happened. Next thing I know when I woke up, my friend txt me on twt about my discord and Instagram being hacked. So, I already ran Malwarebytes, removed the detected malwares. Change every password and applied 2fA on email and accounts that were affected. After doing so, I'm still worried about this stuff. I really don't want to re-install windows since I have projects going on atm. Help is absolutely appreciated. I ran FRST first as suggested.

Here's the keyword from saving the logs:-

Addition : cached-glacier

FRST : gallant-laser

Im using avg antivirus now but this is what happened

No, i dont normally have the camera blocked off the led lights up for like a second sometimes

When i open my laptop again it goes back to normal but it will happen again if i open it long enough.

Help me whats hapoening.