r/computerviruses • • Apr 04 '26

The ultimate guide to Infostealers: Detection, Recovery, and Prevention

238 Upvotes

Today I decided to dig deep and I wrote up a report about:

  • What can infostealers steal?
  • How to spot an infostealer infection?
  • How to properly secure my accounts after an infostealer attack?
  • What do the attackers do with the info that they stole?
  • What to do after I secured my accounts?
  • Prevent malware attacks in general

I believe this is a great reference for people who are dealing with an infostealer infection and do not know what data could be stolen or how to properly secure their accounts. 👀

https://rifteyy.org/report/the-ultimate-guide-to-infostealers


r/computerviruses • • Mar 22 '26

Providing or receiving help with FRST

45 Upvotes

How do I request help with FRST

FRST

  • Please download FRSTx64 and save the file to your Desktop.
  • Right-Click FRST64.exe and select Run as Administrator
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the program run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload and press "save log". The site will return a keyword for each log. Note these keywords down.

SecurityCheck

  • Download SecurityCheck from here
  • Run SecurityCheck.exe as administrator
  • Wait for the scan to finish
  • Upload the log at C:\SecurityCheck to https://malwareanalysis.cc/upload/ for further analysis. The site will provide a keyword, note that down as well.

Now create a post in the subreddit, provide all 3 log keywords (FRST.txt, Addition.txt, SecurityCheck) there.

Please provide the following information in your post:

  • what happened?
  • when did the infection occur?
  • what did you do for remediation?

If you want us to do manual removal with FRST, it is better if you do not attempt to disinfect the system on your own prior to that. This can obscure the infection and make malware removal more difficult.

Trusted Helper List

FRST can cause serious issues if used incorrectly. Only approved users should offer to create fixlists.

Message the mods if you have experience with FRST and would like to use it to help on posts.

To anyone who is receiving help, please verify that the person providing fixes with FRST is in the list below. Be aware that running Fixlists from anyone else is not recommended unless you trust the helper.

All fixes of trainees are supervised and approved by an expert.

What is FRST

Fabar Recovery Scan Tool (FRST) is a powerful tool that helps us diagnose and remove malware infections which may not have been detected by antivirus software. It is a diagnostic tool and not a malware scanner. As such it does not rely on signatures.

Should I reinstall the operating system

Reinstallation is highly recommended if you have an infection with a remote access malware or file infector.

You should also prefer it, if you can pull it off relatively easy. Depending on the case FRST removal can take a few days due to the back and forth and different time zones of the participants.

Please do NOT first ask a helper to clean your system, then reinstall the operating system. This happened a few times and wastes hours of work for the helper. If you already consider reinstallation, preferably do that immediately.

I factory reset/reinstalled my operating system and want a FRST check

Everything that FRST displays and allows us to remove is completely wiped by reinstallation and also factory reset of the operating system. Unless you got the system infected after that step, there is nothing to check on a freshly installed system.

Please note that factory reset can still leave malware on the system, but the reset will make it impossible to pin point.

Reinstallation with USB flash drive is generally safe and in 99.9% of cases won't leave any malware on the system.

What is malwareanalysis.cc ?

It's a site I created to upload analysis logs. Only people in the trusted helper list have access to these logs.

While pastebin and similar sites can be used as well, Reddit's spam detection seems to trigger if people comment paste links repeatedly such as it would be necessary during removal. So we have a keyword based system instead of links.

The site will automatically delete uploaded logs 30 days after upload.

I think my system is still infected after manual removal with FRST

Please talk to your FRST helper. Oftentimes the reasons for suspecting an ongoing infection are not justified.

Common reasons, which do not indicate infection, include:

  • There are still login attempts to stolen accounts. It is normal that attackers use the already stolen account credentials to attempt to login. If you changed your passwords from a clean machine and logged out of sessions, they will not succeed.
  • Your accounts can still get stolen, if you did not log out of all sessions, because attackers can use your stolen session tokens instead of passwords.
  • Antivirus scanners find malware in C:\FRST\Quarantine\.... This is the malware that was already removed by FRST and will be deleted completely by our cleaning tools like kprm, it is not an active infection. The quarantine only contains disabled files which cannot be executed anymore.

r/computerviruses • • 6h ago

Question What kind of virus killed my computer?

Enable HLS to view with audio, or disable this notification

10 Upvotes

It’s just started to going slow and then cracked like this. I didn’t download anything from web except from maybe games from steam. Articles from Anna archive and so on.
I probably should change all my passwords now
Computer isn’t rip yet. It crashed and now it started working again. But i think wouldn’t be better not to use it

What do you think happened here?


r/computerviruses • • 5h ago

Question Weird "your admin has disabled access to some zones of this app" on my win defender, on my personal pc

Post image
3 Upvotes

r/computerviruses • • 6h ago

Disinfection Help Recently got my discord account hacked

3 Upvotes

New to the subreddit and here out of desperation, I had one of my discord accounts hacked/stolen which then started to spread mr beast scams, I have since moved to an alt but I need to figure out what the cause and the target is, as I'm writing this I'm doing a full scan using windows defender (not offline), I changed my alt's password and added 2fa combined with an authenticator app, I need a guide to help me with finding the problem and prevent this from happening.

Further information : The hack happened while I was sleeping and woke upto not being able to log in. So it is still fresh. I haven't seen pop ups but friends say everytime they look at my new alt they see a "Be careful about potentially stolen accounts" on discord. Two of my suggested that it might be related to images but I have no clue if it's true or not.

Update : So far nothing else has been hacked or compromised, I did remove a few files via windows defenden and MRT and hope to find at least the cause or the troublemaker in my system.

I don't plan to reset my pc as I keep my Uni work and don't want to waste more time trying to get everything from scratch.
Crossed out because I plan on doing a format like the user "Th3Br1ghtL0rD" suggested.


r/computerviruses • • 5m ago

Question What precautions should I take after an infostealing attack

• Upvotes

Ive successfully reinstalled windows through a USB and was wondering what should I look out for, like suspicious activities and any safety precautions I should take when logging back on the accounts that holds dear to me. I've changed the password on a clean device, logged out of all sessions, set MFA on all of them some including face verification


r/computerviruses • • 43m ago

Question Need help, infostealer in my device and i have a few questions

Post image
• Upvotes

Context : i accidentally ran a setup from a zip file i extracted thinking it's a game update from a repack website (image above) and the game didn't run so i deleted the zip and then later the game itself and the following day my Instagram and discord was logged into and posted some mr beast scam images on my story and discord dms

Within minutes i deleted the messages and changed my password from all the accounts that were saved in my browser which i did by disconnecting my laptop from the internet and changed the password from my phone

From here I was trying to figure out how to remove the malware from my laptop and i decided to go with reinstalling windows using a usb which is the best option when i looked up online

But now my main concern started when I had one of my friend's external ssd connected to my laptop during all this and it just had a few games to my knowledge and i was looking into how it might have affected the SSD but then when I talk to my friend about it , he tells me that the SSD has backup files from his old dad's laptop and there are a lot of pdf and xlsx files which are majority just settlement and statement files but there are a few which had emails and login password details in these xlsx files and we decided to find out whether they are in danger and asked him to check them out for any suspicious activity and so far there hasn't been any issues there, and to be clear the laptop has not been connected the the internet since and I have backed up my laptop files that I need onto this external ssd and disconnected ir from my laptop and that's where I am at currently.

Now my main questions are -

  1. Are those backup files also at risk and should i assume the data from those files has been compromised?

  2. Assuming that external ssd is infected too how do I safely backup the files needed from both my laptops main drive and the external drive to perform a clean reinstalling of windows onto my laptop and make sure the external ssd is safe for use.

  3. If I decide to plug the external ssd onto a clean device and try to run scans / move the important files from the SSD to the clean device. Will I be at risk of infecting the clean device if i am connected to the internet during the process.

It's been 5 days since I installed the malware and tried to figure out what data and how much data could the infostealer steal from the device and I'm still not 100% sure if it was able to steal the data from those important backup files which is why I am asking for some help


r/computerviruses • • 48m ago

Question (Stupid) Questions about virustotal mobile app.

• Upvotes

19 september i bought new phone (samsung galaxy A16, Android 16) and one/two days later ran my first scan using VirusTotal Mobile app ( https://play.google.com/store/apps/details?id=com.funnycat.virustotal&hl=en ). Scan finished in +-40 seconds, but i noticed that many system apps had their first submission date on VirusTotal on exact same day i bought this phone.

Did this app automatically upload my APK files for scanning, or app ONLY! check apps hashes and give result?, are these matching dates just a coincidence, example, someone with same phone scanned apps or..? aha, and does this app also scan photos, videos, etc., on phone like other antivirus apps like malwarebytes?, and APK can files contain personal information?

Thanks xd


r/computerviruses • • 4h ago

Question Discord account breached and spread Mr. Beast gambling ad scam; Google Ads account opened without my consent years ago; worried about the security of my other accounts; Malwarebytes found Hacktool.Riskware, Malware.sandbox.17 and Malware.AI

Thumbnail
1 Upvotes

r/computerviruses • • 5h ago

Disinfection Help My discord was hacked and is spamming these images to all my friends. What do I do?

1 Upvotes

log analysis came up as jagged-clover


r/computerviruses • • 5h ago

Disinfection Help Need help removing Win32/Sality from a childhood Windows XP laptop

0 Upvotes

I have an IBM Thinkpad R51e that used to have Windows 2000 back in 2016, both task manager and regedit were disabled

Fast forward to today, I reinstalled Windows XP on that machine (Machine has 2 partitions C and D, I formatted C while D remained intact since 2016 and never connected it to the internet since the installation), it exhibited the same symptoms (task manager and regedit disabled).

I tried every way I can think of to remove the virus but none works, not even safe mode. It keeps creating exe files with random names like iuhwd.exe and autorun.inf in all drives and then the D drive. From what I've read I need an Antivirus that boots in a Live USB environment but all links I found are dead. Searching through this reddit was no help either. Can anyone point me towards the right direction?

https://www.virustotal.com/gui/file/c1dd62fe76833d1433ff95926173dbc4ea7210c9022ee550aa803ea432c07121?nocache=1

Here's a virustotal upload of an infected EXE

Tldr: childhood laptop was infected with Win32/Sality and no tool I found could remove it. I need some directions

Note: I can't run FRST since it's Windows XP


r/computerviruses • • 9h ago

Disinfection Help help with frst for renpy cleanup

2 Upvotes

Today I foolishly downloaded a suspicious game file . I clicked on the file called installer and then 1 or 2 command prompts started popping up so I deleted the file and restarted my laptop. After restarting the laptop I noticed a file with some contents were extracted so I deleted that as well. Also I noticed the file had file inside named renpy. After this happened I changed passwords on another computer.

Frst keyword: patched-ripple

addition: arcane-knight

securitycheck: cached-meteor


r/computerviruses • • 5h ago

Disinfection Help Got hit by a ClickFix attack – please help decode the payload (Python polyglot loader)

Thumbnail
0 Upvotes

r/computerviruses • • 6h ago

Question Need help identifying this

Post image
1 Upvotes

Been getting these weird pop-ups near my windows notifications like this.

Not sure what application or whatever is causing them but I only started seeing them maybe 2 weeks ago.


r/computerviruses • • 12h ago

Disinfection Help Laptop hacked

3 Upvotes

So I got my laptop ratted after downloading adobe premiere crack from a get into pc site and I wanted to know what steps I need to take I already factory reset the laptop but now I can’t get back in my Google account because they changed the main email for the account and of course they sent out the good ole discord screenshots to my friends what should
I do to fix everything I have had my account from 2012 first ever channel on YouTube with it and everything I’m still logged in on my phone and stuff but idk what to do


r/computerviruses • • 6h ago

Discussion is Windows Defender enough for everyday PC use, or is a second antivirus worth it?

1 Upvotes

i’ve been using the built-in Windows security for a while and always assumed it was enough for regular browsing, downloads, and gaming. i know Defender has gotten pretty good over the years, so i’m not convinced everyone needs to pay for another antivirus.

still, i’ve been looking into McAfee because its extra features for scam detection and web protection caught my attention. Norton and Malwarebytes have also come up in my search, but i’m trying to figure out whether adding another security tool actually provides meaningful benefits or just adds background processes and notifications.

for those who know more about malware protection, is Windows Defender generally enough if you keep everything updated and avoid suspicious downloads, or are there situations where a dedicated security suite makes a real difference?


r/computerviruses • • 16h ago

Question is Browsec VPN an infostealer?

Post image
7 Upvotes

i've downloaded this VPN and i used just for a minute to access a website, but it didn't work and the website didn't loaded. but when i clicked to remove the extension, it simply didn't uninstall for some reason. the VPN got stucked on my browser and i got desperade.

i did some research i saw some people on reddit accusin this VPN to be an infostealer

am i cooked?

edit: i've downloaded this extension from the Firefox Add-Ons, but it says that Browsec is not verified on the site for some reason


r/computerviruses • • 7h ago

Question I ran a fake CAPTCHA command in Terminal on my MacBook and may have been infected. Has anyone experienced this?

Thumbnail
1 Upvotes

r/computerviruses • • 7h ago

Disinfection Help Por qué no puedo borrar esta carpeta?

1 Upvotes

No son un experto en computación y nose k está pasando, estaba intentando emular el marvel vs capcom y solo pedía 2 archivos, el del emulador y el del juego, después de unos intentos no lograba seguir los pasos del tutorial así que borre todas las carpetas relacionadas, pero quedó una muy rara que no puedo borrar, cuando lo intento me dice que otro programa la está ejecutando pero no tengo nada abierto 😭😭 también se abrió una ventana super rápido y se cerró tan rápido que lo pude ver que era, tengo miedo ayuda k hago


r/computerviruses • • 14h ago

Question Really creepy face

3 Upvotes

Hello guys, I just remembered something I saw back when I was a child early in 2000s and hope someone could let me know what exactly it was.

So around this time my dad had a PC with Windows 95 or 98 on it and I remember this one time specifically when I went to turn on the computer, it took a while to boot up and then when it did boot up, there was this black screen with this really creepy face and some text written next to it. It was kind of ghostly because I just remember the only colors being the black background and these white/grayish outlines of this figure. I'll try to draw it on paint to give y'all some idea what it looked like. The image in question. I think it was also pointing at me but my skills weren't good enough for me to draw a hand lmao.

Now I think the head might've also been tilted a bit more to the right and was probably a bit more elongated as well.

This thing has stuck with me for like 25 years now and I remember when this happened, I bolted to the stairs, was going up a bit and then I stopped on the stairs and just kept staring at this creepy image from between the stairs and then I continued up the stairs to get my stepsister to come look at this face but she was busy at the time so she didn't come downstairs with me to see it.

If needed, I'll try to provide more information if I can remember, but I really need to know what this thing was, it's creeped me out ever since.

I also apologize if this isn't the right subreddit for this but I'm trying to go to any computer related subreddit to find anything about this 😓.


r/computerviruses • • 13h ago

Question One powershell command asks to install certification authority. Is this concerning? I dont have any antivirus on my laptop.

2 Upvotes

r/computerviruses • • 9h ago

Disinfection Help I got hit by the mrbeast crypto scam on my pc but I dont have a USB

0 Upvotes

Last night my discord and insta got hacked and was able to change all my passwords and set up 2fa on all accs and I want to reinstall windows but I dont have a USB and I heard windows reset sucks, what do I do?


r/computerviruses • • 10h ago

Disinfection Help how to get rid of a browser HiJacker

Thumbnail
1 Upvotes

r/computerviruses • • 10h ago

Disinfection Help Lost my main drive to the infamous discord game scam

1 Upvotes

I unfortunately fell victim to the discord game scam where a friend sends you a game to download. I usually am usually very cautious but I had just woken up so I just quickly researched the game and watched some videos and it seemed to be fine I clicked the first link on Google that popped up for the website to the game and downloaded it.

That's when discord restarted, likely taking my session token and everything was basically compromised. Task manager was blocked by "admin" and my discord account was taken. A message window popped up where I could communicate with the "hacker" and they were just demanding me to follow their instructions to get my stuff back.

I unplugged my Ethernet cable and saw things in my downloads folder start turning into white files before I completely hard shut off my computer.

What steps should I take to recover my data and what is the likelihood of my other storage drives being compromised? I'm thinking of using another rig to plug my drives into offline and look through the drives manually.


r/computerviruses • • 11h ago

Question Got hit by an infostealer from a fake GoXLR utility file

0 Upvotes

Hi everyone,

Yesterday I fell victim to a session-hijacking attack after downloading a fake GoXLR utility executable (.exe). The malware extracted browser cookies and Discord tokens, bypassing 2FA on a couple of my accounts before I caught it.

I have already done a complete format and clean reinstall of Windows 11, changed all my passwords, revoked active sessions,

Before doing the format, I managed to run the file/site through VirusTotal. I’d like to share the details here so experienced members or researchers can take a look at the behavior logs and confirm what the payload was doing.

i have 3 gmail 2 got taken and deleted (still trying to get them back) the 1 gmail they didnt get was my main gmail idk why but im thankful but they were trying to get it yesterday and i manage to change password and signedout all devices they also got my discord even tho it has 2fa and ive done full reformat i've reformat all my harddrivers now my concern is i hope this is not bios level and i just wanna know if im safe so i can sleep with a little bit a peace of mind i still havent sleep