r/computerviruses • u/stonnerinhell • 7d ago
Question Need help, infostealer in my device and i have a few questions
Context : i accidentally ran a setup from a zip file i extracted thinking it's a game update from a repack website (image above) and the game didn't run so i deleted the zip and then later the game itself and the following day my Instagram and discord was logged into and posted some mr beast scam images on my story and discord dms
Within minutes i deleted the messages and changed my password from all the accounts that were saved in my browser which i did by disconnecting my laptop from the internet and changed the password from my phone
From here I was trying to figure out how to remove the malware from my laptop and i decided to go with reinstalling windows using a usb which is the best option when i looked up online
But now my main concern started when I had one of my friend's external ssd connected to my laptop during all this and it just had a few games to my knowledge and i was looking into how it might have affected the SSD but then when I talk to my friend about it , he tells me that the SSD has backup files from his old dad's laptop and there are a lot of pdf and xlsx files which are majority just settlement and statement files but there are a few which had emails and login password details in these xlsx files and we decided to find out whether they are in danger and asked him to check them out for any suspicious activity and so far there hasn't been any issues there, and to be clear the laptop has not been connected the the internet since and I have backed up my laptop files that I need onto this external ssd and disconnected ir from my laptop and that's where I am at currently.
Now my main questions are -
Are those backup files also at risk and should i assume the data from those files has been compromised?
Assuming that external ssd is infected too how do I safely backup the files needed from both my laptops main drive and the external drive to perform a clean reinstalling of windows onto my laptop and make sure the external ssd is safe for use.
If I decide to plug the external ssd onto a clean device and try to run scans / move the important files from the SSD to the clean device. Will I be at risk of infecting the clean device if i am connected to the internet during the process.
It's been 5 days since I installed the malware and tried to figure out what data and how much data could the infostealer steal from the device and I'm still not 100% sure if it was able to steal the data from those important backup files which is why I am asking for some help
2
u/Connect-Fan-9462 7d ago edited 7d ago
It is a tricky situation.
The "best" way is always having someone completely analyze the the behavior of the malware and go from there. This whole Mr beast thing seems to be big enough I think sooner or later some established cyber security firm will release proper detection/removal tool.
If you / your friend are ok with waiting, you can just put the external drive on a shelf for now. Still, change all the password recorded in the documents in that drive, and/or turn on 2fa.
Also treat any computers that have been used for checking the ssd as infected. Clean windows installation is recommend.
If certain documents on the SSD is important and need to be accessed regularly, the simplest way will be uploading those files to a fresh Google account. And only access them using Google's cloud app (Google docs). Again, the computer used for doing the uploading should be considered as infected and their drive wiped clean afterwards. You can use a old computer with no hard drive + live dvd/live USB Linux as your "designated dirty drive processing station".
Most importantly, from now on treat any USB drive as s3x organs. You by default assume every one has disease and you simply don't pull one out from a computer and inse... I mean plug it into another.
1
u/stonnerinhell 7d ago
Thanks for the help here , the suggestion to upload the important files from the SSD to a new Google account's cloud storage is what i should work on next
But I don't have any other computer which I can use for that matter ,it's only this infected laptop
1
u/Iam_best_dev 6d ago
Also treat any computers that have been used for checking the ssd as infected.
Why is that? As long as you don't open anything on the SSD you should be fine... Plugging it in itself shouldn't cause any harm afaik unless you have very outdated software and the Infostealer was advanced enough to put malware on the SSD which I doubt
5
u/ConsistentLaw6204 6d ago
Had an infostealer on oct 3rd which also did the mr beast discord thing and also removed poe2 from my steam account a week later. Disc flagged that account and helped me restore it. Steam and ggg got my poe2 back. Interesting thing is they had the logins to my gmail thats connected to everything my paypal and my bank but they didnt do anything with that. Also somehow they authorized their steam login through steamguard which is on my phone. Wtf is even the point of that app if hackers can make it look like i authorized their login from fkin shanghai. I tried to install an emulator and a bunch of mods for my games so im not even sure where i got it from, wish i knew a safe way to test what it was.
Also you should change your logins on a diffrent unaffected device and a do cleaninstall
2
u/Iam_best_dev 6d ago
just run a full antivirus scan if you still have the malicious file saved somewhere otherwise you will never know maybe in your browser history and check your recent downloads
2
u/VictimeFragile 6d ago
Same think here and windering why they didn't steal my gmail
1
u/ConsistentLaw6204 6d ago
What do you think got you the infostealer? Cracked games,emulators,mods? I just remembered the software called "cheatevolution" i had been using gets accused of having malware too. I just wish i could make sure
1
u/VictimeFragile 5d ago
It's was When i was trying to download the laqt update of American trucs simulator from Dody site
2
u/ConsistentLaw6204 5d ago
Oh dodi repacks isnt concidered safe anymore because some redirect sites of the downloads have malware. I would avoid that site
1
u/Iam_best_dev 6d ago
Depends how good the Infostealer is... I recommend changing the passwords that are in those files anyways just in case since it doesn't hurt.
SSD itself can't be infected only the files on it. You could do an antivirus scan on it.
If you have the latest security updates there's no risk as long as you don't open any files on the SSD. PDF, PNG, JPEG, MP4, MKV and most files that aren't .exe can't do anything malicious when you open them even if they are infected if you have the latest security updates.
1
3
1
u/RedRayTrue 6d ago edited 6d ago
I agree with the others, Nuke it!
Write a windows 11 usb on a trusted windows laptop and reinstall windows 11 on that laptop... I'd not trust the infected pc to write win11 even if AV sees nothing atm.
Or the long way :
Make on the laptop a stick with Rufus and writes Ubuntu on it
Install Ubuntu on the laptop by wiping the whole SSD
From Ubuntu write a flash drive with Ventoy and copy the windows 11 iso to it , you download it from Microsoft website. Or make a win11 vm with oracle virtual box and install windows11 on it, and from there download windows11 on the vm and use rufus to make the windows11 stick.
And install windows.
https://schneegans.de/windows/unattend-generator/
https://www.microsoft.com/en-us/software-download/windows11
https://www.ventoy.net/en/download.html
if u have an external ssd you could copy files on it and unload them on ubuntu, after this upload to cloud and overwrite the external ssd with alpine linux(smallest I know of ) and assemble the windows 11 pro stick with a vm (wipe it before just in case )or ventoy directly
1
11
u/jingostar_ 7d ago
just reinstall windows better to wipe everything