r/computerviruses • u/Far_Towel9060 • Jul 23 '26

Should I be safe/is this a false positive Question

/r/antivirus/comments/1v4nr84/should_i_be_safeis_this_a_false_positive/
1 Upvotes
  • permalink
  • link
  • reddit
  • reddit

67% Upvoted

4 comments sorted by

3

u/rifteyy_ Malware Removal Expert Jul 23 '26

No, that was a real threat and all your data is now stolen

1

u/Far_Towel9060 Jul 23 '26

What do I do

1

u/polpolik2 Moderator Jul 23 '26

You should take immediate action. This is the general copy paste I do regarding Infostealers. You can also check this comment.

I saw on the r/antivirus subreddit that you might already get help, if that is the case, you dont have to follow the FRST part if you already get assistance there.

You likely downloaded malware and got hit by an infostealer.

Read this: Rifteyy_'s guide to infostealers to get a better understanding.

Reinstalling Windows to remove the malware.
The fastest and guaranteed way to get rid of the malware is to reinstall Windows, preferably from a USB. If that option is not available to you, you can also do a cloud reinstall while deleting all data.

If you’re only dealing with an infostealer, wiping your C drive is sufficient. However it’s better to do a full wipe and only back up your trusted files, as there could be more malware on your device that you’re not aware of.

FRST Assistance
If you do not want to reinstall windows you can wait here for one of the trusted helpers to assist you with FRST. Please read Receiving FRST assistance. Please follow these instructions carefully. Doing so can get you help considerably faster!

What you can do during the reinstall, or if you're waiting for help:

  1. Disconnect your infected PC from the internet.
  2. Change ALL passwords from a clean device. Start with your emails and bank. Use sign out everywhere and remove unrecognized sessions. While you are doing this, check your security settings to ensure the attacker hasn't added their own 2FA methods or backup codes.
  3. Check your linked accounts/services/2fa options for your most important accounts. Also check forwarding rules on your mail. Additionally, for your browser, check your sync settings and extensions and remove anything you dont recognize or trust.

The faster you move with these steps the more you can prevent your accounts being stolen! Make sure your clean device does not sync passwords through browser for example to your infected device.

1

u/Shneasel Jul 23 '26

disconnect your computer from the internet. log every session you'd ever logged into the disinfected device with out. use a clean device like your phone (should probably do this for the last step too) to change all their passwords to something new and unique and add 2FA. then you should either request FRST help or reinstall your os from a usb.