Mrbeast scam on discord

[u/mystiquelaw]

2 days ago i downloaded a .exe file (im so dumb ik) then the next day i woke up my discord sending mrbeast scams and my tiktok posted russian comment. I discovered suspicious device on my tiktok which then i changed password on my phone and log out all sessions. Did the same on discord (tho there was no other devices log ins) and ALL of my accounts (gmail, fb, ig)

The discord and tiktok breach happened for 1 hr.

I can still access my accounts on that day and there were no other log ins except from my devices.

I also do MFA for all of my accounts then reinstall windows with cloud. Now, i keep checking suspicious log ins on ALL of my accounts and there are nothing suspicious, only my phone and ipad. There are also no other suspicious activities.

Am i safe now from the malware? I keep overthinking since i only do cloud reinstall. And i also saw reddit posts that they somehow bypasses mfa which makes me worried. I keep scanning it from time to time with malwarebytes and no threats detected. Is there still a possibility that the hacker will breach my discord and tiktok again? Or even my other account?

edited: i already reinstall windows w usb as what you guys recommended. thank you

[u/Few_Reference3439]

If you didn't reinstall Windows from a USB key, the odds are very high they have your new passwords and will use them as well. Everything I've read about the Mr Beast infostealer says it requires a reinstall of Windows from USB before the infection is resolved, and until it is resolved it is actively sending all account passwords to bad actors.

*edited to add*

I missed you said you had reinstalled from cloud. I am unfamiliar with this method - did it allow you to delete all the partitions during the process? If it deleted/overwrote ALL partitions on the machine, you should be ok. Malwarebytes cannot find these infostealers, to my knowledge, so a clean scan isn't a promise you are clean.

[u/Th3Br1ghtL0rD → u/Few_Reference3439]

is there no way around ? no antivirus that can save op ?

[u/computerviruses-ModTeam → u/[deleted]]

We appreciate you giving advice, however in this specific scenario your comment was deemed too generic, possibly harmful to the user or is not entirely relevant to their case from what they described and the details. It is also possible that you haven't elaborated on your advice enough, you haven't instructed the user on what to exactly do step by step or provided false sense of security to the user.

This includes (and is not limited to) recommending diagnostic tools for experts, recommending forensic steps that are unclear, recommending removal steps that are tricky to perform for the average home user and steps where it is easy for unexperienced user to cause damage to their device / operating system, determining false or true positives based on not enough input or data or recommending steps that are not entirely necessary.

We appreciate you trying to help regardless. If you want further explanation, you can reach out via modmail.

Please make sure to read and follow https://www.reddit.com/r/computerviruses/about/rules

[u/Few_Reference3439 → u/Th3Br1ghtL0rD]

None that I've seen mentioned in the hundreds of other Reddit posts on this.

[u/mystiquelaw → u/Few_Reference3439]

Like “remove everything” ??

Sorry i am unfamiliar with the “partitions” but i did remove everything in the cloud reinstall

[u/Few_Reference3439 → u/mystiquelaw]

I sadly don't know how cloud reinstalls work. During a normal USB reinstall, the installer will show you the partitions on your disk, and you can choose to delete them all until it is all just unpartitioned space. That is the best way to wipe the drive. A cursory google search indicates cloud reinstall will delete the primary partition, so long as the infostealer doesn't hide in a secondary partition you should be good.

[u/Arrowguy232 → u/mystiquelaw]

Most places I seen recommend full delete all partitions and do it from a USB. It’s sad and it’s cumbersome but to be 100% it’s better to go nuclear. Just boot safe mode, backup whatever you want and if it’s a usb scan it first before executing anything inside.

[u/mystiquelaw → u/Few_Reference3439]

hey…i already reinstall windows from usb. so am i clear, right??

[u/AutoModerator]

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

1. From a different and clean device, change all your passwords:
   • How to properly secure my accounts after an infostealer attack?
2. Disinfect your device from malware
   • Preferred method: Perform a clean installation with a USB

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/baselocksec]

There is ways to bypass MFA. If you reinstalled from a known good version from the cloud then it’s likely that you are good but consider passwords, existing sessions, etc need to be rotated and cleared out.