r/computerviruses • u/vengence291 • Jun 21 '26
Disinfection Help What should i do
How to remove it. Should i wipe out my entire pc
30
u/LateAd6694 Jun 21 '26
What even is ChatGPTstealer?
68
8
u/Weak_Incident_3484 Jun 21 '26
malicious browser threat that embeds itself in Chromium extensions to steal AI conversational data
3
1
9
u/Available-Pizza8568 Jun 21 '26
Cache viruses don't run, so remove it using windows defender. If you are paranoid about it being a real threat, then reinstall your OS and don't visit shady websites to never get it again.
4
u/Spec1alP0s1t10n Jun 21 '26
Try to install and run Kaspersky Virus Removal Tool (KVRT) from here: https://me-en.kaspersky.com/downloads/free-virus-removal-tool
5
3
u/Unlucky_Ad4879 Jun 21 '26
Straight from Microsoft:
"Trojan:JS/ChatGPTStealer.GVA!MSR is a browser-based threat that targets user interactions with large language models. The malware embeds itself inside Chromium extensions to steal conversational data from AI platforms like ChatGPT and DeepSeek. Unlike traditional credential stealers, this threat collects the content of user prompts and AI responses, including proprietary source code and internal business information.
The threat actors distributed malicious extensions disguised as AI assistants, virtual private networks, and productivity sidebars. Several of these tools received the Featured badge on the Chrome Web Store, which made them look trustworthy and increased their visibility. The malware uses a delayed payload mechanism to avoid automated security reviews. It reads browser memory and the Document Object Model, then sends stolen data through HTTPS POST requests to domains controlled by the threat actors. This shift from stealing credentials to stealing contextual intelligence represents a new kind of corporate espionage, where the details of a user's work become the main target."
So check your extensions, ideally if possible disconnect your PC from the network and do a fresh install of Windows.
Uninstall any AI assistant extensions.
4
1
u/f2pmyass Jun 21 '26
I'm not saying yours is what I had but I to had a cache virus from Firefox and I believe it's nothing to worry about.
I simply got it for visiting a website no download or nothing. What I did is simply did the quarantine and removed it. I then did many scans including a offline one and everything seemed fine. I wasn't too worried because I've seen others post about a cache virus from browser and say it's nothing to worry and it can't do anything.
Nothing has happened to me at all.
If you download something and installed something and something like this popped up then probably you're screwed
1
u/technoturge Jun 21 '26
Did you search for "deep seek" on Google or visit the deep seek website recently?
1
1
1
u/konfyr Jun 22 '26
seems like the trojan is hiding in brave's appdata, you could either reinstalm brave from edge, google etc and if the trojan is still inside or flagged by your antivirus, reinstalk windows with an usb.
IMPORTANT
btw you can see at the end that it's some sort of JavaScript file or thing being executed in the browser. Ddi you acceptes something or clicked on some rand popups?
1
1
1
u/Ok-Employ-4051 Jun 23 '26
Remove it. Use Zen.
1
u/d1a2x3o Jun 23 '26
How would that help lol? The user could still install a malicious extension even in Zen so there is no difference
0
1
u/Crafty_Claim6802 Jun 28 '26
Just factory reset and change your passwords this is what to do whit most viruses not all but most
1
1
u/Weak_Incident_3484 Jun 21 '26
malicious browser threat that embeds itself in Chromium extensions to steal AI conversational data
no dont do that just download malware bytes and done
1
0
u/JKdaKilla Jun 22 '26
If you are doing illegal things you should virtualize, if you are just clicking on links that people pm you, you should stop doing that and ask if a link is real before clicking on it.
If you can afford it, social/entertainment on one device and business/banking/email on another.
As for malware on windows, nowdays its just easier and safer to format your machine instead, unless its a malware that embeds into your bios or special partitions, which is very rare.
-5
u/LongjumpingLeek5542 Jun 21 '26
What were you even trying to run? Google a guide (using your phone) for clean reinstalling Windows from a separate drive
2
u/vengence291 Jun 21 '26
Mannn i am dumb. Iwas trying to download a web series from a site🥲
1
u/Incanus_Lothrolien9 Jun 21 '26
Were you redirected and clicked an ad or something? Be sure to have ad ublock origin for firefox. Or any ad blocker so that you won’t be clicking ads, and get redirected. A lot of malware comes from those.
1
u/idontlikebansthanks Jun 21 '26
The browser OP uses is Brave, which has an built in ad blocker, Maybe OP disabled the built in ad blocker?
43
u/ROCKERNAN89 Jun 21 '26
Appears it could be some weird false positive from brave cache files but still take precautions.