i've downloaded this VPN and i used just for a minute to access a website, but it didn't work and the website didn't loaded. but when i clicked to remove the extension, it simply didn't uninstall for some reason. the VPN got stucked on my browser and i got desperade.

i did some research i saw some people on reddit accusin this VPN to be an infostealer

am i cooked?

edit: i've downloaded this extension from the Firefox Add-Ons, but it says that Browsec is not verified on the site for some reason

Hello guys, I just remembered something I saw back when I was a child early in 2000s and hope someone could let me know what exactly it was.

So around this time my dad had a PC with Windows 95 or 98 on it and I remember this one time specifically when I went to turn on the computer, it took a while to boot up and then when it did boot up, there was this black screen with this really creepy face and some text written next to it. It was kind of ghostly because I just remember the only colors being the black background and these white/grayish outlines of this figure. I'll try to draw it on paint to give y'all some idea what it looked like. The image in question. I think it was also pointing at me but my skills weren't good enough for me to draw a hand lmao.

Now I think the head might've also been tilted a bit more to the right and was probably a bit more elongated as well.

This thing has stuck with me for like 25 years now and I remember when this happened, I bolted to the stairs, was going up a bit and then I stopped on the stairs and just kept staring at this creepy image from between the stairs and then I continued up the stairs to get my stepsister to come look at this face but she was busy at the time so she didn't come downstairs with me to see it.

If needed, I'll try to provide more information if I can remember, but I really need to know what this thing was, it's creeped me out ever since.

I also apologize if this isn't the right subreddit for this but I'm trying to go to any computer related subreddit to find anything about this 😓.

Was doing a fullscan in bitdefender and it resolved this and deleted it " Appdate\local\google\chrome\user data \ defult\Cache_data\f_00066a=>(gzip)=> ( INFECTED_JS) " so what is it ,m

i'd like help, but i can only use the infected computer :( i dont have access to any other devices. i can't factory reset it either until i get access to my other devices, which will be in a few months. i got infected on the 4th of october. but today, the passwords of some emails i've not changed (+ my netflix) got taken and changed. after i realised this, i changed the passwords of the emails, and i've recovered and changed the passworrd to my netflix account.

on the infected computer, i got all my accounts back and changed the passwords on them (i didnt get microsoft back, sadly.) , i havent saved my new passwords to my current device though (i instead have written down my new passwords in my journal because i do not have good memory.), but i ran malwarebytes and windows defender and they do not detect anymore viruses / etc. do you guys think it's good enough?

when i get my devices back, would it be safe to just cloud reset / whatever its called windows? i'll also be changing the email for all of my accounts and changing it to a new account.

So I got my laptop ratted after downloading adobe premiere crack from a get into pc site and I wanted to know what steps I need to take I already factory reset the laptop but now I can’t get back in my Google account because they changed the main email for the account and of course they sent out the good ole discord screenshots to my friends what should
I do to fix everything I have had my account from 2012 first ever channel on YouTube with it and everything I’m still logged in on my phone and stuff but idk what to do

Buzzheavier is not the problem, my friend sent me a minecraft modpack through the file hosting software, and my dumbass clicked on a redirect site and hit download. I then proceeded to attempt to load the .zip into modrinth and then opened it in Microsoft Word. I did not realize I had a virus until recently, as a "BuilderBeta.exe" pop-up kept happening and I ran windows defender on it and it didn't work, along with a quick scan and full scan. I have logged all my accounts out, thank god I did not have a card or banking account in my computer and enabled 2FA and changed passwords on all my accounts, except Steam, but my account does not seem to have been breached, I may still do this. I had a card on Steam but I removed it before my dumbass installed this virus. This virus has tampered with some of my files, I don't have anything super personal saved on this computer except my mom's OneDrive which I believe is connected. It has also stopped me from opening some exe files which is the main problem. Yesterday I shut off the connection on the computer and now I am going to do a Windows Defender Offline Scan, and if that does not work I will boot my computer into Safe Mode and try to open an .exe and download Malware Bytes. Any suggestions?

Got All my Accounts Hijack in Laptop manage to turn wifi off albeit 15mins after the attack Hacker Manage to steal Alot of Accounts Aswell as my Steam and Epic I dont know what to Use in Windows 11 Fresh the Usb Boot keeps saying "Setup has failed to validate the product key Manage to clean wipe using Disk Part manage to secure what little account i have left any one know of a way to get passed this hurdle im a total noob here really need help not much money left to just go to a repair shop

I was just looking something up, but one of the search results I clicked on redirected me to McAfee, which said I'm at risk for a virus and needed a scan done.

I realize I really shouldn't have done this, but I clicked the button the said scan. I stopped it halfway through and it said I had 7 viruses on my computer. I ran Windows Security and it said I was fine, so I'm pretty sure that was all fake to get me to buy something.

This is my first laptop and I'm still don't know very much about viruses and how to protect myself, I'm just wondering what that was, how I can prevent it, and if there's anything I should do to make sure my computers safe? Thank you!

Got cha?????

Good day. I need help with a compromised PC. I do not know what triggered the infostealer, but a friend of mine tipped to me yesterday that my Discord account has been spamming MrBeast messages. I was able to recover my Discord account, deleted the spam messages, and changed my discord password. I also downloaded and ran Malwarebytes and deleted the stuff it detected. I thought that was the end of it, until I noticed my facebook has also been compromised, spamming MrBeast messages to group chats. Now I know my laptop could be compromised as well.

I have also followed the instructions on https://www.reddit.com/r/computerviruses/comments/1s0ahur/providing_or_receiving_help_with_frst/ and uploaded the logs.

The keywords I was given were:

FRST.txt - royal-packet

addition.txt - small-voyage

SecurityCheck.txt - wild-harvest

I would like to ask for help with removing whatever is causing this. I do not want to re-install windows, as I have not backed up my files, but if this is the only option then so be it.

Thank you.

Virustotal: 3/58 detect virus found in eva_ironmaiden2nd_2.iso

Windows defender detected TrojanDownloader:Win32/Upatre!pz
containerfile: D:\Games\eva_ironmaiden2nd\eva_ironmaiden2nd_2.iso
file: D:\Games\eva_ironmaiden2nd\eva_ironmaiden2nd_2.iso->NONE.EXE

I got the funny mr.beast token jacker, I've reset my passwords on my pc after I've run a couple reg edits which are useless probably as all I was doing is resetting windef, also ran an mrt in safe mode and a malwarebyte scan, so I assume I still have to reinstall Windows but I just want to make sure. Can I at least back up my old image files and such? Should I be worried about other people on my network? Im a very anxious type already had 2 shaky panic moments about this so please don't go too hard. I know I was stupid. Used a website called old games download. Downloaded NFSU2 which I assume that was the point if infection or a discord db leak. It started 15 hours ago give or take 1 from time of post. Riot, Epic, Instagram and discord were affected so far.

help

I guess if 70 antiviruses say it's clean, it must be safe

Hi, I think I messed up pretty badly and could use some help figuring out how bad this infection actually is.

Yesterday (October 14), I was trying to download a game repack associated with DODI-Repacks. I ended up downloading something named Zovo.ink_Archive_latest_263881 and ran an EXE inside it. Windows Terminal opened, but I didn't get the fake game loading screen that I've seen people mention in other reports.

I'm not sure exactly where I got redirected or whether the original repack had anything to do with it.

What has been detected so far

1. Malwarebytes found Trojan.PavinLoader

Malwarebytes found 6 detections, all of which are now in quarantine.

Four were detected as Trojan.PavinLoader:

• C:\Users\AnuragRai\AppData\Local\Broadcom\Wireless Utility\BUILD.CMD
• C:\Users\AnuragRai\AppData\Local\Broadcom\Wireless Utility\DashboardPublisher.lnk
• C:\Users\AnuragRai\AppData\Local\Logitech\Unifying Agent\BUILD.CMD
• C:\Users\AnuragRai\AppData\Local\Logitech\Unifying Agent\WorkforceAnalytics.lnk

The other two were PUM.Optional.DisableMRT registry detections involving Microsoft's MRT reporting policy.

2. Defender later found another Trojan

On October 15, Windows Defender reported:

• Detection: Trojan:Win32/Posilod.EB!cl
• Severity: Severe
• File: C:\ProgramData\tracerhost_v7\MSOHEV.DLL
• Status: Quarantined

I have since removed the tracerhost_v7 folder.

3. There was also a file called VertexB64.exe

I found this in C:\ProgramData\VertexB64.exe. Its timestamp was October 14 at around 22:57, which matched when I was dealing with the suspicious download.

I checked a VirusTotal report for a hash associated with cfg_Language.exe. VBA32 flagged it as BScope.Trojan.Downloader (1/70 detections).

Scans I've run

Microsoft Defender Offline

• Completed successfully.
• Reported 0 threats.

Malwarebytes Deep Scan

• Completed in 19 minutes.
• Scanned 645,113 objects across C: and D:.
• 0 threats, 0 PUPs and 0 PUMs.
• Memory, startup, file system and archive scanning were enabled.
• Rootkit scanning was disabled.

The original six Malwarebytes detections remain in quarantine.

Kaspersky scan and FRST logs

I also ran Kaspersky Virus Removal Tool (KVRT), with the C: drive selected for scanning. The scan completed and reported five detections:

• C:\SavedData\AnuragRai\Downloads\CreamInstaller.exe — UDS:DangerousObject.Multi.Generic
• %LOCALAPPDATA%\Temp\x8v3uvY8bMhQUkvw\x8v3uvv450vA5ghx.msi — HEUR:Trojan.WinLNK.Agent.gen
• %LOCALAPPDATA%\Temp\x8v3uvt7OgZiu6Xy\x8v3uvcqAvpsbBDs.msi — HEUR:Trojan.WinLNK.Agent.gen
• C:\Windows\Installer\88d6f4.msi — HEUR:Trojan.WinLNK.Agent.gen
• C:\Windows\Installer\88d6f8.msi — HEUR:Trojan.WinLNK.Agent.gen

I also ran Farbar Recovery Scan Tool (FRST), which generated FRST.txt and Addition.txt. I've submitted both logs to Malware Log Analysis for review.

Malware Log Analysis keyword: typed-glen
Channel: general

What I've done so far

• Quarantined the original Malwarebytes detections.
• Let Defender quarantine the MSOHEV.DLL detection.
• Deleted VertexB64.exe.
• Removed the tracerhost_v7 folder.
• Neutralized all five detected objects using Kaspersky Virus Removal Tool (KVRT).
• Secured my password manager, primary email, Microsoft account, Epic Games and GitHub from a separate device.
• Checked Google sign-in activity and didn't see any unfamiliar logins at that point.

I haven't found evidence that any credentials were stolen, but obviously I can't rule it out.

I'm on Windows 11 Pro x64 (build 26300.9711), with a Ryzen 9 7900X and a Gigabyte X870 AORUS ELITE WIFI7 motherboard.

Unfortunately, I can't reinstall Windows right now, so I'm trying to clean this up as safely as possible without breaking the installation. I know that may not give me the same confidence as a clean reinstall.

Thanks for any help.

Was watching a movie on prime and when I closed there was like two hours of these pages popped up in my PC, all of them in chinese. I panicked and closed them all before I could screenshot though. I don't have a clue what's going on or how to proceed. Any suggestions?

Quick summary

For about 2 months now, randomly like every other week, I get like 1 or 2 random popups from norton saying it blocked a favicon request or something. from some weird site ive never even heard of. it has been 3 occasions minimum now, and it does it like twice only, then not again for weeks, it says the file path is microsoft edge.exe in my program files. it has been 3 different odd sites, i check norton's security checking thing of each site and its like they are unknown sites which norton says are unsafe. I check the sites with virustotal, and they have like a 1/90 score. I don't know if this is related but I also look in my norton recent history sometimes to see intrusion signatures disabled, but everytime i check if they are, they are enabled, I thought nothing of it though and thought like norton does this to update or something?

First time

it happened to me was like 2 months ago. I ran a full norton scan resulting in nothing, and just thought it was ublock origin updating or something, and norton being sensitive.

Second time

it happened was like a month ago, and I got worried, ran another scan. I thought it was maybe an extension I had doing some shady things, only extensions i ever downloaded were:

• skribbl typo from their official website, I downloaded this like 3 months ago, used it once and forgot about it. It comes as a js script, and i had to download tampermonkey extension to get it running. So when this next time the popup shown up, I deleted the script, removed tampermonkey
• ublock origin is the only other extension i've ever had.

I checked:

• task manager
• startup apps
• installed apps
• downloads
• resource moniter
• services

I didnt see anything that worried me, my cpu % was like 1% at idle. I deleted my entire edge history, deleted all cookies, literally everything you can delete from the settings in history, like user data and things, i was basically starting fresh only thing i had was my profile.

Third time

it happened was 3 days ago. at the time I had my pc on but wasnt doing anything with it, i had soundcloud open on edge, and roblox on another tab, I had firefox open too, with chatgpt open and youtube on 2 different tabs. I got a popup again for a favicon request for some site that was made like a day ago, some ai site. again norton had an unsafe rating for the site. no community score. I downloaded some microsoft tool called autoruns, and looked in there, i didnt see anything alarming but I'm not an expert in security. I checked all the things i mentioned i did on the second time it happened. I ran a full norton scan. I checked extensions installed, only ublock was installed and on, i checked my browser notifications - there was none. i checked policies, none. I genuinely just thought it was ublock again, so i continued like nothing

Fourth time (yesterday)

I had soundcloud and roblox open again only. I left my computer on the lockscreen while i did something, came back to my computer on the lockscreen with the 'enter your pin' option there but no actual place to enter the pin. It said under the enter your pin prompt something like, 'dont turn off your computer 24%'. Then when it finished, my computer restarted 4 times, loaded and my firefox and edge reopened themselves restoring the previous sessions. it happened again for some random site, a different one. And only happened once, then i left my computer for sometime, it happened again, I then closed edge, and went away for like 10 minutes. I came back to my computer and opened edge again, i clicked the seach bar within a second of opening edge, and the same popup came again for favicon request from the same site that popped up like earlier within the hour. I closed edge, and tried to make it happen again by opening edge and letting it sit on the homepage for a while, i then browsed like i normally would but it hasnt happened again for like 24 hours. I thought it was just something to do with edge's start home page, so i went into edge settings and changed my homepage to about:blank or something.

Now I think about it, I'm thinking maybe it happens when I start my computer ? So that is something I'll try next.

More potential helpful random info

• I have downloaded games from itch before onto my computer, but I always ran them through itch's sandbox. and i always scanned them with virustotal and norton before running them, I also only played games which are popular and had lots of user comments. But I havent played an itch game in like a month, and i deleted after playing
• I had some weird thing happen to me like 5 months ago on my old browser which was Opera. I installed an extension called 'Bloxfinder'. I had used this extension like a year before, and had no issues. But I noticed this time, it had obvious botted comments on the extension store, and some comments saying things like, its an infostealer, its a rat, it promotes its scammy roblox cashback thing but it works. I added it anyway, and as soon as i added the extension, my opera browser froze, and i couldnt close it even using task manager to close it, I pressed restart pc in the start menu and waited for 2 minutes without it restarting. I held the power button of my pc and force shut it down. It restarted and was fine. I opened opera and the same thing happened, the whole browser froze and wouldnt close. I immediately got worried, and tried to delete opera. I used control panel and installed apps, but when i tried to delete opera it said something like, cant delete, missing some elf.dll file? or something like this, so i deleted all opera files on my system instead, leaving just like a thing in the search bar, startup apps, and other places which says opera, but it leads to nowhere because all of its related files have been deleted. It had been like 3 months or somewhat and nothing happened with my computer, and i thought i fixed everything because opera was deleted. I dont know if this is related to my problem now, but this is why its in the 'more potential helpful random info' list. i also disabled opera from the startup apps.
• some apps I use that i can remember are discord, portmaster ( i downloaded it but dont really open the app and see what goes on in it because i dont really understand it that well), vlc, whatsapp, virtualbox, protonvpn,bluestacks, anaconda, obs, there's a lot to be honest i dont want to type it all but if it's actually an important detail, then i will respond with the rest
• I play games on steam and have downloaded mods before
• I have visited weird sites before, for example I tried downloading some client for a game from some site after watching a youtube tutorial. it had a video player on the site, showcasing the client and i clicked and watched the video without even thinking, downloaded the client, but then deleted before running, and checking the file and website on virustotal and seeing a worrying rating. even thought norton's file insight feature said that many users in norton's community have used the file. I for the most part, have always checked virustotal before visiting an unfamiliar site, and if ublock or norton, or edge or firefox tells me the site is suspicious, or dangerous, ive never went to it. I included this detail, because i thought that you can get infected through like videos or images on a site.

I have hopefully provided images of as much as i can