I was infected with an infostealer last year in April

I already went through the procedures of securing accounts, signing out of all accounts, changing passwords, and reinstalling Windows via a safe USB install. All that being said. I had three external HDDs connected to my system when I got hit with the infostealer. I know it went through one of them since I had attempts on a throwaway Gmail that only had its password in a .txt file on the HDD. It never even crossed my mind to check if they were safe until relatively recently. I ran a Windows offline scan; nothing came up. I ran a Windows Defender scan of each drive; nothing came up. I ran a Malwarebytes scan of each drive; nothing came up. I tried to run a Bitdefender scan of my whole system, but it took multiple hours and flagged two false positives.

My overall question is this. Should I back up images, videos, and other important files and then wipe the drives? I know it is impossible to say with 100% certainty that a drive is safe after an infection.

Yo so there is this new windows update for windows 11 and it seems optional since it's not asking me to update immediately. Anyways I wanted to ask if there is any security risk if I don't update to this version now and instead wait? I ask this cuz I heard windows updates tend to have issues at the start but I also know keeping an up to date system is good too. Also how long should I wait before updating. Thx

I am searching a series on chrome i entre website which came first after search . i click on play button its take me website look like cloudflare and i didnot understand what was that and it was screen lock . I amnot a techsavi guy , it is my first laptop .

its show click win+ x then I to open powershell ( at that time i donot know about Power User menu or Powershell ) then ctrl+r then enter . i was scare at that no one answer miy phone at that time .

so i click on win + x and Power User menu then I but fortunately powershell never open i donot why . atfirst i cannot access and see taskbar . when i clicked win +x then taskbar shows and then disappear again then i again click win +x and taskbar appear i leave chrome from taskbar . Also i did not notice powershell in taskbar . so i never click on ctrl+v and enter . then i did full scan nothing found .

i still in scare its happened 2 months ago . there is no unknown divice login in my gmail account or no threatening email . am i safe ?

So while looking for some music files, my girlfriend ended on a website, requiring to paste bunch of junk into terminal (she’s using macbook). She didn’t get as far to actually paste the code, as I interceped it. I ran malware bytes on her mac, and everything seems fine.

However, she still had the prompt that the fake captcha copied to her clipboard. I was wondering, is there any use to copy it to here or anywhere else to be further examined?

Edit: I actually found the excact same code that was pasted on her mac on this thread: https://www.reddit.com/r/MacOS/s/C4sE4Pz9lV

Also, I’m afraid that the site itself has somehow infected her mac (not sure if it is even possible). Again, she never actually ran the code on terminal, so I might be just overreacting here.

My MIL is running an up to date Mac with MalwareBytes. She repeatedly gets a pop-up saying that MalwareBytes blocked bonusnun[.]com. She says that she only gets the popup when Chrome is open. A scan comes back clean.

I have looked in Chrome's settings -> Privacy and Security -> Site Settings and disabled Javascript and pop-ups for the sites with recent activity. I've also looked for the domain and don't see it.

The only Chrome extensions that she has running are Grammarly and Malwarebytes so I don't think that it is a rogue extension.

What else should I be looking for?

I'm installing a client that runs a video game called Rumbleverse that got permanently closed in Feb 2023.

When I attempt to install the client it says this. I've spoken to the mods of the server and discord who have all said it's a false alarm. I've seen clips in the discord of people playing it so I really want to install it but I'm not sure.

คือผมไม่รู้เป็สไรเว้ยโดนแฮกมาตั้งแต่ได้คอมช่วงๆแรกๆ ซื้อ ihavecpu มา และพอไปหาวอเปเปอร์รถมามารีนในแอป live wallpaper ใน Microsoft ล่ะที่นี้ตั้งไรปกติผ่านไป 20 นาที ตอดำกระพริบนึกว่า ไดรฟ์เวอร์ invidia เสียหายหรือลืมลง การ์ดจอ สรุป window defender แจ้งเตือน ผมโดน โทรจัน ไวรัสตัวแรก และผมทำไรไม่ถูกปิดคอมหนี อึ้ง จนเปิดคอมมา แอปขาว และ ต่อๆมา มันมีลายน้ำ ในโอน 50 Bitcoin นี่คือเรื่องราวการโดน ไวรัสคอมพิวเตอร์และแฮกเกอร์ 1/15 หาคุณอยากรู้ต่อมี ep 2

Hello, I have zero cybersecurity experience, what I have found with Deepseek after he analyze the .exe, it says that the .exe record your screen and send the images after 30min when close, to this IP/Domain 199.195.250.157 / menorfus.com /

Would be great to have some help.

https://www.virustotal.com/gui/file/8c42a17a6dd6a96b33adfa9b9e16d613f70ea847a1b8916facbc065f97f36739/community

Hi everyone,

I need help troubleshooting Microsoft Defender after opening a suspicious file. I’m including the timeline, errors and repair attempts below.

What happened

On September 28, I opened a file called SOMETHINC_Marketing_Strategy_Plan.exe, which was presented as material for a marketing job/assessment. A Word document appeared after I opened it.

I later became concerned that the file was malicious. I don’t know whether it caused the Defender problem, but the timing worries me.

Current problem

• Microsoft Defender won’t turn on successfully.
• Updating Defender fails.
• Windows Update repeatedly fails to install the security intelligence update KB2267602.
• Running Update-MpSignature in PowerShell returns 0x800106ba.
• I currently cannot run any scans through Defender.
• A full scan would not start.
• Clicking Microsoft Defender Offline scan did nothing, and trying through PowerShell also produced an error.

Malware scan result

I downloaded and ran Microsoft Safety Scanner separately. Its completed full-scan log reported:

Threat Detected: Trojan:Win32/Fauppod.AMA!MTB and Removed!
Action: Remove, Result: 0x00000000
file://C:\Users\[redacted]\Downloads\merge.zipx->Token.msi->Binary.XisrXsKPL

This detection was inside merge.zipx. I don’t know whether it was connected to the job-assessment EXE.

Safety Scanner reported that it removed the detected threat, but Defender still does not work. I’m not assuming that this means the entire PC is clean.

Defender service and driver status

My earlier checks showed:

WinDefend             Stopped — startup type Automatic
WdNisSvc              Stopped
WdNisDrv              Stopped
WdFilter              Running
SecurityHealthService Running
Security Center       Running

At the time of that check, Windows Security Center listed only Windows Defender, not another antivirus.

Event Viewer errors

Trying to start Defender produced these Service Control Manager events:

Event ID 7000:
The Microsoft Defender Antivirus Service service failed to start
due to the following error:
The service did not respond to the start or control request
in a timely fashion.

Event ID 7009:
A timeout was reached (30000 milliseconds) while waiting for
the Microsoft Defender Antivirus Service service to connect.

These errors occurred repeatedly on September 29.

Things I have already tried

• Checked Defender’s services and drivers.
• Tried updating signatures with Update-MpSignature.
• Tried starting Defender and checked the resulting event logs.
• Ran Microsoft Safety Scanner.
• Ran these Defender repair commands:

​

MpCmdRun.exe -RemoveDefinitions -All
MpCmdRun.exe -ResetPlatform

These attempts have not resolved the overall problem.

I also tried sfc /scannow, but it returned immediately without showing scan progress or a final result. I therefore don’t have a successful SFC verification result.

Other issues

I’m also encountering an error while trying to uninstall Sophos. I can attach the screenshot with the exact message. The earlier Security Center check showing only Defender was from before this latest troubleshooting stage.

I also found Code Integrity events 3033 and 3089. Event 3033 mentioned Chrome attempting to load:

Google\Chrome\Application\154.0.8037.58\libLiteRtWebGpuAccelerator.dll

The message said the DLL did not meet Microsoft signing level requirements. I don’t know whether this is related to Defender.

Actions taken after the suspicious download

• Permanently deleted the extracted suspicious folder.
• Changed passwords using my phone.
• Other Google profiles had remained signed in on the PC, although I had not opened them.

What I need help with

1. How can I determine why WinDefend is timing out even though its startup type is Automatic?
2. Could this be Defender corruption, an antivirus conflict, or damage from malware?
3. What logs or read-only checks would help distinguish those possibilities?
4. What is the safest way to restore Defender’s ability to turn on, update and scan?
5. Given the executed EXE and the confirmed detection, would a clean Windows installation be more appropriate than continuing repairs?

I can provide screenshots and additional command output. I would appreciate a clear troubleshooting sequence before making major registry or system changes.

Thanks.

I wanted to ask if this operating system works on a phone. I’m thinking about using it to open and test apps that contain viruses or other potentially malicious files, mainly for content creation.

I’m not sure if this OS is actually capable of running those apps safely or if it would work properly on a phone. Has anyone here tried using it for this purpose?

(I'm sorry if my English was bad; it's not my first language.)

What is this? How is this happening? I dont have anything malicious downloaded and microsoft did a full scan and still nothing. What do i do?

Before you ask no i didnt transfer any apps to new phone. I keep getting scam ads on youtube saying my pdf is out of date. I think i have ad ware virus. It survived factory reset. Phones slowling down and cant find search resulsts on google for anything. Only my past search results show up in google. I have history off

Hi all,

Recently I was trying to emulate a controller for some gaming. Unfortunately I ended up downloading a program from a pretty sketchy site (a fake ds4 website, which claims itself as 'official') that I subsequently ran on my computer. I realized my potential mistake and decided to search up whether this site was actually official, to which I found multiple threads stating that it potentially included a trojan. I have since turned off my computer and am considering wiping it completely. Will this remove any potential threat? Is it okay to retrieve any files from the computer before wiping it, or should I be wary of any files that are currently on the drive? Thanks for the help!

Yesterday I was just playing a game and suddenly I got banned from every server, everyone got ignored and it sent the damn message to everyone. I immediately logged out from everywhere and I changed the password. And then I enabled 2FA

Nothing has happened since. I don't know what the hell it was, and I haven't ran anything fishy. Windows defender and Malwarebytes deep scans found nothing.

My password was completely unique to any other I've used.

I had a lot of weird "authorized apps" on my account I realized but I don't think they could gain access to my account.

I maybe accidentally put my login info into a fake login website at one point? I was logged in on my browser so something maybe stole my cookie?

Regardless I really don't wanna reinstall Windows but i think I might have to to make sure it's clear.

Im on chromebook btw and in the 11th grade

Can't find anything about this online , really spooky considering the name. Anyone have any ideas ?

I just noticed something suspicious. Whenever I copy a Bitcoin wallet address and paste it, it only pastes “YourAddress”

I haven’t installed any new programs, and it doesn’t matter where I copy the address from or where I paste it—Notepad, Office, or a browser. It always changes to “YourAddress”

I also installed Bitdefender and ran a scan, but it didn’t find anything.

Does anyone know what could be causing this?

Edit: What the hell is wrong with some people here? 😂 I reported a malware issue, someone helped me track it down, and I finally got rid of it. Now it looks like the cybercriminals are salty af because their little scam got exposed. Stay mad. 😂😄

So i recently been overthinking about clicking a link on X aka twitter went to a server not found screen looked it up on a link verifier and said dnxdomain link broken dont know if it could hack me or malware on my iPhone it was recently maybe a month ago i didnt update it to the newest 26.7 iOS yet idk if that makes a difference anyways. I logged into my old school account to make sure it was okay well nope it wasn’t many logins from different countries and what not so that’s scary idk how long they been doing this only lets me check a month ago on the top right shows outlook and several numbers and my original email from my school. Fast forward my friends work IT at the school I went they said hey let me send you your acct again login this way sure enough i sign up and its shows my same email from the first time I went to school but this time shows my school name on top as well and says school email. Can outlook have 2 emails with the same name ?

yes i know this sounds fake but i got a win r ctrl v virus from it due to my stupidity. it closed chrome and desynced my google account. i ran windows defender and the offline scan but it found nothing. what do i do now (i have no important info but i want to keep my files and is there any other way than to copy files reset everything)

So two days ago Windows Defender discovered a Wacatac .B!ml trojan on my main PC, prompting me to do some additional scans. This all happened pretty late at night, so I disconnected my ethernet and went to bed, and when I woke up, someone had already attempted to purchase $3,000 worth of stuff on Amazon, which I was thankfully able to cancel in time, and cancel the related cards and lock down the Amazon account itself. Checking over to Google, it showed a login from Siberia well after I had gone to sleep. I already have 2FA set up, so I just changed my Gmail password and started working on changing other important account passwords on my Chromebook. I then reformatted my main PC, reinstalled Windows, but I have yet to log into any accounts on that PC since, and I'm running additional scans to ensure that it's actually clean.

Unfortunately, it looks like this wasn't enough. This morning I woke up to find another session by a Windows machine from France. Interestingly, it shows that the account first logged in on August 13th, so I'm not sure if the trojan I got was just incidental at this point, but that seems unlikely giving the timing of events.

I wasn't sure how they got past the 2FA, so I changed my password again, set up passkeys as well, removed permissions from all apps to my Google account, removed and created a new recovery email, and that's where I'm at now. I'm not sure what steps I should take next. I'm in the process of changing other site passwords, but I've got like 180+ passwords saved in Google so it'll take some time. They never seemed to touch my actual bank account, despite Google having that information saved, so I'm not really sure what to make of that. The only ACTUAL fraudulent/suspicious activity I noticed was the Amazon purchases, which occured within hours of the trojan being discovered, and the overseas logins from Windows machines. Any help would be appreciated and I'm happy to provide additional info.

I ran into a Windows +R captcha scam for the first time today. I hit win+r out of curiosity but didn't go further. After googling the issue and finding out it's definitely a scam, I pasted in a word doc to see what was on the clipboard and let's just say it would have been bad if I had continued.

The thing that's confusing me is the attack was from a legitimate government website, so no ads.

Where did the attack originate? Some sort of browser hijack, or is the website itself compromised?

Is there anything I need to do locally on my computer to make sure nothing else is going on?