i downloaded an .APK on my phone then deleted It. But suddenly i saw a Google sign in from Nevada. I changed my google pass and then i checked Discord and i saw this, is there any thing i should do? I already changed my Google and Discord pass. I have a Oneplus7pro running lineageos23.

im just a little worried but i jus want to be sure yk? i havent really noticed these things running before and my pc feels a little slower than usual. Im no pc expert i just want to be reassured

and i heard savvyfinder is malware also my browser changes constantly also i didnt install this "antivirus" (its probably not even an antivirus) also he did install something weird and it came with adaware web companion (which i deleted) what is it help im going crazy

My PC got hacked and I believe it's because I've downloaded something while looking for cracked Adobe softwares.

After being notified by a friend that my Discord account was sending these Mr. beast images, I immediately unplugged my ethernet cable from the PC. It was also able to get a hold of my Instagram as it posted a story of the same Mr. Beast account.

I've already changed passwords to both my IG and DC accounts and have the 2FA on.

I've also logged my IG account out to all devices.

I've reset my PC but was too scared with the idea that the virus is still there so I reinstalled my OS with a bootable USB.

I am still worried that they might still have access to my accounts as they are very important to me. Am I still in danger or am I just overthinking everything?

This is my very first time being hacked so I'm very conscious if I'm safe with everything I did. I honestly feel so dumb being hacked after years of being safe and honestly being pretty good at avoiding these stuffs.

Note: The messages in discord were sent around like an hour before I rebooted my PC

I've checked my accounts and it did not detect any unusual devices logging in even though they DID access my accounts

Facebook comprised. This is popping up on antivirus, have I got an info-stealer? What steps do I take to further stop attack and prevent them in future.

i kinda started getting this pop up every time i search on google chrome since yesterday,
i just wanna know if it’s something i should be worried about and how to fix it.

im not sure if this is related but i clicked on a sketchy website before this and im kinda worried about it.

sorry if this isn’t enough information and mind my grammar

I was scrolling in my fyp normally till i noticed a story 27m ago about this elon musk crypto scam? I only got a notification on my email that i got hacked and told me to change my password, when inchecked the security thing on insta i couldn't find any location or ip about the hacker, and also they didnt even change my password or anything they just posted this and probably left my account

i never clicked on any suspicious link Recently or used any thirad oart apps, fitgirl, nothing so im curious how did i get hacked?

I do not use any wifi I only use ethernet and I don’t have a wifi adapter. My google cloud account was hacked today and I lost 50k usd of balance due to hackers using 15 thousand cpus to do cryptomining. Im not sure where the breach came from but I have my eyes on a suspicious process (wifiautoinstall 32 bit). Can anyone tell me if there’s anything malicious on here and how do I remove it?

is my notepad infected or something?? i swear it doesn't use this much memory

Woke up this morning with the images attached sent to group/private messages on Meta Messenger. Already changed my facebook password on my iPhone, and enable 2FA. Removed the email they used to log-in. Im not sure what device was compromised, as I use a Lenove Laptop and an iPad. Im not sure if I clicked on anything weird as most of the links I’ve clicked are from job postings from Jobstreet and Indeed.

Soo, i cant really help him becuse i dont know him in person, he is part of the dev team im in, but i want to know what could he possibly do to get this, this is the second time seeing this first time i saw something like this was in 2025, and i saw ir often in discord servers im part of, so just curius, how this happens

SCAM IMAGES DONT FOLLOW WHAT IT SAYS

I recently added a chrome extension which seemed really sketchy, but considering I have interacted with sketchier things without encountering any issues, this one definitely did something. It started sending these mrbeast thingies to everyone on messenger. I had already changed password on everything before it started this mass spreading, except messenger.

But anyways should I be scared that it could also reach other chrome profiles I had? There were other peoples information on those different chrome profiles but it has only seemed to affect the chrome profile I was using, since it was the one I installed the extension on. I asked chat gpt and they told me its nothing serious but what do you guys think?

Basically, my grandparents laptop has been infected with some kind of virus. (browser hijacker).

Since It is a medion from 2017 I am coming here to ask if it would be smarter to reinstall windows, or to get a new laptop.

I have briefed my grandparents about viruses and scam sites and since they are still installing shady stuff, I was thinking about getting them a Mac, as according to google, they don't get viruses that often (I don't own apple devices, so idk if that's true), and since they don't use it all that often I was also hoping to get some recommendations on some cheap other more modern laptops.

About the virus:

It seems it was something they downloaded, as Malwarebytes hit 18x in something called recepies(dot)exe.(Downloads)

I suspect it is a browser hijacker that reroutes all searches through malicious sites. (pictures)

Upon removal of 1st malicious site through nuking google, Grandparents have managed to get on a different malicious site that opens upon startup of the browser within a week.

Promptly installed Malwarebytes after that.

Also, has the suspected virus anything to do with the search engine being suddenly changed to yahoo?

They were using google as the browser, and I didn't set yahoo as the search engine. (pictures).

According to Malwarebytes the malicious sites were caused through the installed Pup's.

I quarantined all 18 hits and called it a day, because the laptop was slower than anything I've seen before.

I now have all day to potentially reinstall windows, or to buy something new, what do y'all recommend me doing?

Cheers,

P

Hi, I believe my PC may have been infected after my accounts were hacked, and I’m trying to determine whether malware is still active on my computer.

I found a file called PerfMonHost.exe at:

C:\Users\[USERNAME]\AppData\Local\Microsoft\Windows\Diagnostics\Performance\PerfMonHost.exe

The file was approximately 6.76 MB and was modified on August 16, 2026 at 14:50, which is the same day my accounts were compromised.

I uploaded the file to VirusTotal and it received 33/43 detections. Several security vendors identified it as a CoinMiner/CryptoMiner/XMRig/Trojan, and Microsoft detected it as Trojan:Win32/Vigorf.A. VirusTotal also showed threat labels such as miner, trojan, loader, and XMRig.

Windows also showed a warning saying that part of the application had been blocked because it could not verify who published PerfMonHost.exe.

I also found other files around the same date, including:

• RuntimeBroker.exe
• md.cp312-win_amd64.pyd
• _simd.cp312-win_amd64.pyd
• codec.pyd

Some of these were located in Python/Codex Runtime directories such as site-packages, numpy_core, and codex-runtimes.

One _simd.cp312-win_amd64.pyd file had 0/70 detections on VirusTotal, so I understand that not everything I found is necessarily malicious.

I also saw VirusTotal relationships involving files such as CortexNode.exe and FishTracker.exe, with some samples receiving detections.

My main concern is: Could PerfMonHost.exe or another piece of malware be stealing passwords, browser data, Discord sessions, cookies, or other information from my PC?

My accounts were compromised around the same time these files appeared, so I’m trying to understand whether there could be a connection.

I have intentionally removed my username and other private information from this post. I will not post passwords, cookies, tokens, IP addresses, recovery codes, or other sensitive information.

What should I check to determine whether the malware is still active and whether any of my information could have been stolen?

I'm a minor, my PC got hacked and I'm getting blackmailed

I'm 15 (M) and I'm honestly freaking out. Someone claims they put a RAT on my PC and recorded me Gooning and dressing. They've been demanding money and saying they'll share the recording. They have all my passwords and got it correct.

I ran a security scan for around 3 hours and it found nothing, but I don't know if I can trust that. I've disconnected my PC from the internet and I'm planning to completely wipe Windows 11 because I don't care about any of the files anymore.

Could someone please tell me if this sounds like an actual RAT infection or if they're probably bluffing to scare me into paying? I'm not paying them, I just want to know what I should do next. The only thing I have done that was bad is download and run Solara, xeno and wave. (roblox cheats)

Edit: I reinstalled Windows and downloaded steam and set Microsoft Windows defender to Real-time monitoring. I'm dead serious when i say THANK YOU so much to everyone that helped. I changed all my passwords and deleted a few accounts. But seriously. Thank you

So if you wanted please see my last post and tell if my laptop is cooked?

So 3 days ago i downloaded mod from 400k vievs YouTube video i installed it from google drive link that was in description of video i played it everything was normal until i heard that this mod can stole acc or something I uninstalled mod right after i stopped playing it now i reinstalled it to check it in jarscanner and it showed me critical risk of minecraft session stealer i immidianetly changed my microsoft account password enabled 2FA and now im scared if something gonna happen i checked logins into my microsoft account and there was nothing suspicious just my logins its been 3 days since i played this mod nothing happened i done scan it showed me nothing suspicious nothing in my minecraft account no skin changes etc should i be worried now and can someone delete my worlds ?

After installing a special version of software, I got this. I disconnected the WiFi and shut down the router immediately. Tried to close it but would keep popping up then shut downs the computer and turned off all access to internet. After turning on the computer it did not show up, the software is downloaded and working. It seemed like it was scanning every single file in my computer. What is this, is this very serious? How can I get rid of it?

Is this normal?

I just downloaded CDburnerXP and it’s giving me this pop up, I’m panicking, especially since these questions are creepy.

Hi, I need some help figuring out whether my PC is still infected or if I am only seeing a leftover startup entry.

SYSTEM SPECS:

- Windows 11 Pro
- Version 25H2
- OS Build 26200.9168
- AMD Ryzen 7 5700X
- NVIDIA GeForce RTX 4060 8 GB
- 32 GB RAM
- 1 TB SSD

WHAT HAPPENED:

Today, Windows Defender detected:

Trojan:Win32/Wacatac.B!ml

One of the detected files was:

C:\\ProgramData\\InProcSvr32\\sqlite3.dll

Another detected sqlite3.dll was also inside ProgramData.

Around the same time, I started getting repeated Windows error popups from a program called:

CircuitryAg.exe

The errors I have seen are:

"The application was unable to start correctly (0xc0000906)."

and:

"The code execution cannot proceed because sqlite3.dll was not found."

This all started shortly after I downloaded and executed something from a ZIP file.

The suspicious download was later deleted/blocked.

WHAT I FOUND:

I checked startup entries using Microsoft Sysinternals Autoruns.

I found an entry called:

CircuitryAg

under:

HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run

It was pointing to something inside:

C:\\ProgramData\\InProcSvr32\\

I disabled and deleted that Autoruns entry.

However, after rebooting, the CircuitryAg.exe popup came back again.

WHAT I HAVE ALREADY DONE:

- Let Windows Defender quarantine the detected files
- Did NOT restore or allow any detected files
- Ran Microsoft Defender Offline
- Ran additional Defender scans
- Checked startup entries with Autoruns
- Disabled and deleted the CircuitryAg startup entry
- Rebooted the PC
- Deleted the original suspicious ZIP/download
- The CircuitryAg.exe popup still came back after rebooting

MY MAIN CONCERN:

Something may still be recreating the CircuitryAg startup entry or launching CircuitryAg.exe from another persistence method.

Does anyone recognize this behavior, the name CircuitryAg.exe, or the path:

C:\\ProgramData\\InProcSvr32\\

What should I check next?

- Scheduled Tasks?
- Services?
- WMI persistence?
- Other Autoruns entries?
- Registry entries?
- Another hidden process recreating the startup entry?

At this point, should I keep trying to clean the infection or would a clean Windows reinstall be safer?

Decided to run hitmanpro because it had been a while, and its detecting steam and warthunder... Surely these are just false positives?

Hello everyone! I don't know if this is the proper place to ask. But this morning when I woke up I saw this weird discord messages sent from my cousins in discord. They have been sent in DM and DM groups, all of them. They are both minors and don't have Twitter (or X) as far as I know, plus they are not that stupid to actually do this stuff, so it cant be them. I don't know what it is or where it came from. I have no idea if it came from their devices or my devices. I have discord in both my phone and my PC, and so do they. Could someone please help me and tell me what is best to do? I will ask my father later, he is a progammer and knows about computers and stuff, but he is at work right now, so I would like know if i should do something in the meantime. Thanks!

Edit (new info): idk if it has something to do with this or not, but their mom just told me thet she has also been getting messages of accesses to her acounts and is changing her passwords. I believe they share one of the home computers. So that might be the problem?