I paid this ransomware because my grandma's will is on here and I need it. How long does it take to get my files back? I'm waiting for the virus to delete itself now that I paid and I need the files back already. What should I do

I left my computer on terraria overnight, and when I turned on my screen this afternoon, I had been logged out. When I clicked to login this popped up! Is it real, is it a fake scam, am I doomed or is there a way around it? I don't want to do anything until I know exactly what it is. Please help me!

EDIT: If it helps, I had a port forwarding rule for this machine. I did just delete it after I saw this.

EDIT 2: I really cannot lose any data on this machine, I have very important files and family things on this computer and its 3 drives. I cannot clean install.

EDIT 3: I did not have backups (very stupid I know) but I am not the richest and do not have much money for lots of drives or one massive drive or even a cloud server for any kind of backup.

EDIT 4: My 'drive in use' light is always on now, it never was before and used to function normally. Hopefully this helps.

EDIT 5: I logged in and its all encrypted for real. Every file over 10mb has this string of text in its file extension: TNT4-tJ-Fdn2YP_oap78PdOCQD_FoQ5DvSx9AmpLG4eW- I tried renaming an unimportant file and its headers are scrambled. When opened it cannot be read. I found out why my 'drive in use' light is always on, these fuckers have some kind of software running in the backround making my drives constantly used and cooking them slowly overtime. My taskmanager is disabled so I can't even open that.

EDIT 6: Ive tried linux now, and it cant mount the drives. It says they are in an unsafe state and are unclean.

Context: I thought I had something called “yahoo redirect virus” and thought I had fixed it; I turned my laptop on the other day, had not touched it (discord is set to launch automatically) and I looked up to see it doing this.

Is someone accessing my desktop remotely and how do I evict them??? Please and thank you - Lenovo IdeaPad Flex 5 14IAU7 w/ windows 11

EDIT: I disconnected it from the internet immediately after recording this video, and have since powered it off. On another device, I have changed all of my passwords and selected “log out of other devices.” I am fortunate that thus far, there doesn’t seem to be any suspicious activity in my various accounts. Hopefully this will remain the case.

To everyone who feels the need to comment on the fact that I recorded a video, but has nothing helpful to contribute: congrats, you got me! I’m a big dumb idiot 🤡 who has never experienced this in their life, ever. It’s my first time. Hence, why I’m here in a subreddit that is dedicated to helping big dumb idiots such as myself. Y’all are a little slow, eh?

To those who have given me advice to help me keep my important files/data and protect my passwords and sensitive info, etc. THANK YOU!! I hope the first sip of your coffee is always the perfect temp, never ever burns your lip, ever!!

I am going to take it to a tech store to ensure the issue is resolved effectively, as this is clearly more than I am prepared to handle on my own.

Hello,

It seems like I was "beasted" (infected) by the infamous Mr. Beast RenPy info-stealer virus. My Discord, Instagram, and Facebook accounts have been compromised and are sending "free money" to my friends. Other logged-in accounts, such as LinkedIn and Reddit, are probably compromised as well, but no "Beast" posts have appeared yet. I have hibernated and disabled the important accounts for now (Instagram, Facebook, and Meta). I have blocked and reset the saved cards, deleted all virtual cards, and frozen the others.

I have reseted my passwords, signed out of all sessions, disabled and re-enabled 2FA, added a passkey, and deleted and recreated the recovery keys for Discord and Gmail. I also checked and cleared forward and filter email. No changes have been made to Facebook, Instagram, or Meta, only deactivation/hibernation. I will definitely clean this up once my PC is cleansed. Will they get my WhatsApp and Telegram accounts as well?

I ran the first scan, which detected the RenPy Trojan and removed it (which i doubt). I am now running a second custom deep scan on the 3drives.

I have a total of 16TB across 5 drives on my PC; the system is only 1TB on a single drive. Most of the data consists of work files. I am wondering if I am able to save my other drives, or if I only need to nuke the system drive. Only two drives are used for storage with no apps installed, while the other three have installed programs. What is the best next step I should take to cleanse the "Beast" from my PC while keeping my files?

• your antivirus detections and logs
  • uploaded
• any potentially related symptoms, popups
  • CMD flashed the moment .exe was ran
• estimate day and time when it started
  • 23/9/2026 downloaded and ran 8:30pm
  • 23/9/2026 spam starts 11:00pm
  • 24/9/2026 first scan 2:54 AM
• share what got your system infected, for instance the download link
• what you did for remediation
  • i've ran Malwarebytes removeved threats, currently still running custom scan on smaller drives C; D; E;

TL;DR:
Can I save the 16TB of files and only format the system drive?

*reposting here since post got deleted at r/antivirus

I fell for this on a website called Mutaz, which I was using to download apps. I had just woken up and started working on some files when I decided that I needed a newer version of Photoshop. As far as I know, they managed to compromise one of my Gmail accounts associated with Steam, my Steam account, and my Instagram. They even posted two stories on my Instagram related to some crypto shit!
I’ve changed all my passwords, enabled 2FA everywhere, and even froze my bank cards because I had one of them saved in Google Chrome.

My question is: I ran two deep scans with Malwarebytes and quarantined everything it found. Can I safely copy my work files to the new Windows installation after reinstalling Windows, or is that still risky? I have around 2 TB of work files, including PSDs, PDFs, Illustrator files, Blender files, etc.

Im using avg antivirus now but this is what happened

No, i dont normally have the camera blocked off the led lights up for like a second sometimes

When i open my laptop again it goes back to normal but it will happen again if i open it long enough.

Help me whats hapoening.

Anyone who sees, please dont bash me😭 this just occured 35 seconds ago because i instantly realized how special needs what i just did and then i see a viral feed instantly saying how smart it is dude my hearts racing

atp idc about my data im going to get to changing everything that matters on a seperate device could anyone help me with what i should do i really have no clue. Last time years ago i had a bad virus when i was younger with my first laptop and theres a local janky computer shop that charged 100$ to boot my laptop on something and hard reset it is that the route im gonna have to go (full resetting myself obviously)

dude im pissed as fuck.. and worried😭 i got my previous long-term MAIN emails locked in the last that made me forever be unablw to access shit so ik the risk im actually anxious someone please respond and comfort me wirh assistance and advice😭

I accidentlly gone to a website and tricked me as it was a microsoft software which made me to win +r and that thing in yhe fjrst photo some lines of words and ig i got a malware what to do. My mcafee didnt detected any malware on a full scan.And also powersheell someyimes pops in taskmanager ans goes

I was downloading something and i accidently downloaded this and ran it i got to know its a malware so maybe 15-20 seconds in i disconnected my internet and changed my google passwords removed/logged out my pc from the devices lists did the same with reddit spotify apple music discord steam twitter every app i could think of i didn't have my banking details on this but i dont know what to do next im really confused i need to remove this off my pc asap i have a deadline tommorow can someone please help ps - I have 2 nvme I have my windows installed on the nvme 1 and i have some important stuff on the nvme 2 they are separated as two different drives do i also need to wipe out my second nvme with my windows one

One of the folks I've befriended have been hacked with the so called “Mrbeast virus” and told them about it. One of them said I must not click the pictures (shown above) but I already did and now they're telling me to change my current password.

Is it true that just by clicking the picture, your device is already infected? This just happened a few hours ago.

Could someone help me? I'm a content creator and I just finished a video that took me 3 months. I tried to contact some people for help but they are charging me money.

I contact them from Telegram and WhatsApp. There is no free tool to decrypt the files as it seems.

My PC is disconnected from the internet as well.

just downloaded this from a fake website , i thought it was the file i need so i ran it without think much , then a terminal popped up and disappeared instantly , as soon as i saw that , i pulled out the ethernet cable , ran both windows defender full scan , and offline scan , they detected some files , i then downloaded malware bytes , he also detected one single threat , he took care of it
what i'd like to know is , am i safe now , or is the malware still somewhere undetected ?
if it still is how can i take care of it without having to factory reset , because i neither a usb to download windows again , nor a second pc.
help me pls

Hey yesterday i went in a trusted site to download online fix for subnautica 2 and when i got to the link i clicked download a new tab opened with almost the same name as the legit online fix , and i clicked and downloaded it basically i fell for it. Its my fault not the website that had the online fix . The folder that i downloaded was this ( i uploaded the picture) . I ran the setup and closed it immediately because i got scared and I realized it was fishy ,and that i fucked up, but the installer didnt finish. I immediately closed it and I thought i was safe but i still ran some antiviruses like bitdefender and windows defender and didnt find anything . Then i went to sleep and when i woke up i saw that someone hacked my discord account and sent crypto pictures to every server and friend that i had. I menaged to change the password and get my acc back . I was wondering if the virus is still there considering i ran windows defender full scan, offline scan , Malwarebytes and enabled scan for rootskit , bitdefender, hitman pro , adw cleaner and found nothing, i cleared the tokens with ctrl shift and delete i think in browser and changed all passwords i had on that pc . But i was wondering considering i immediately closed the installation and deleted the folder, that the virus couldnt get any more data and only managed to hack my discord it didnt even try to log in on my other email accounts, steam, epic games , etc only discord . I didnt get any warnings or anything that someone tried to login . Is there a chance the infostealer is still in my pc or it just got some data and terminated itself.

Hola necesito ayuda, el otro día encendí mi PC y se me creo una carpeta en el escritorio llamada "Ethiopia" y se me abrió el navegador con una página en africano como se ve en la foto, desde ese dia cada vez que enciendo mi computadora me sucede eso, alguien sabe que es? necesito ayuda enserio me preocupa, hablé con chat gpt y solo me dió vueltas sobre lo mismo, aunque me dijo q son archivos q mi PC está creando en ese momento, y que no están haciendo algo significativo en el sistema pq no hay rastro, pero eso no descarta que sea malicioso, alguien me ayuda?

I clearly got duped yesterday and clicked on something I shouldn't and ever since this has been popping up on my screen.

I'm sure there's a way to get rid of it, but I'm not very computer savvy and don't know how.

I can, however, follow directions, so if someone can tell me how to get this crap off my laptop I'd be so grateful!

Anyone know what the hell is this? It's eating atleast half my CPU. And Ive just noticed now. I heard people say it's a virus but it's called almoristics service for them, so just wanna double check and if someone can help me delete this thing.

Title: Windows Security won't open, Safe Mode inaccessible, malware persists after two clean installs - possible bootkit or hardware issue?

Hi everyone,

I'm dealing with a very unusual issue on my Acer Nitro laptop and I'm running out of ideas.

Symptoms

Windows Security (Microsoft Defender) won't open. It either flickers or immediately closes.

Defender previously detected HackTool:Win32/Malgent!MSR, but it couldn't remove or quarantine it.

I cannot access Safe Mode. Even trying through Windows Recovery hasn't worked.

Internet connectivity has also been unreliable, and I occasionally get unexplained pop-ups.

TronScript seems to suppress the symptoms temporarily, but they eventually return.

What I've already tried

Performed two clean Windows installations using the official Microsoft Windows installation media.

Verified that the SSD appears healthy.

Used the official Windows installer (not a custom ISO).

Avoided using "Reset this PC" and instead reinstalled Windows.

I previously had a FitGirl FIFA 15 repack on the system, so I'm aware the detection could be related to crack files. However, I'm not sure if that's the only issue because Windows Security itself won't function properly.

Questions

Could this be a bootkit or firmware (UEFI/BIOS) infection, or is that extremely unlikely?

Is there any way to verify whether Windows Security is failing because of malware or because Windows itself is corrupted?

Would you recommend running a rescue disk (Kaspersky Rescue Disk or ESET SysRescue Live) before attempting anything else?

Is reflashing the BIOS worth trying, or is it unlikely to help?

Are there any logs or diagnostics I should collect to identify what's actually causing this?

Any advice or troubleshooting steps would be greatly appreciated.

I want to share my recent events happened to my discord. Apparently my discord account was hacked and proceed to send some mrbeast scam links to some of my friends without me knowing. Just as soon as my friends noticed and told me, i took action as soon as possible. Recovered my account right away and right now i changed my discord password and set up a 2Factor auth.

​

After some time of research connected to this incident. I discovered that these are called infostealers or some kind of malware. And accoding to it, there are some cases that this cyberattack would probably target my other social media. So i took action again to logout all of my sessions and account in my laptop.

​

Right now, im trying to not touch anything internet related to my laptop and im hoping that nothing happens like this after the next week before i use my laptop again.

​

I just really think that this virus was from when i was looking and downloading some roms for a ps3 emulator. I was searching at the google about some roms then redirected me to a suspicious website.

i didnt expect to be this bad.

​

Im really starting to get nervous and im hoping someone could help me with this problem. Im having second thoughts if i would reinstall windows, a total wipe, or would i just leave it be..

UPDATE: My instagram got hacked and juts posted sum elon musk shit. Im actually panicking

UPDATE2: Reinstalled windows on my laptop via usb, everything looks fresh, im gonna change my password of my major accounts and set an auth before turning on my laptop wifi. This should be fine. Hopefully. 🤞🤞.

Check up update: 2 days after the clean reinstall. I used my onedrive to backup my important files excluding the .exe ones, only my word documents, pictures, and csp drawings.

I started reconnecting my few accounts after some courage and bravery to step up my anxiety. So far nothing has happened.

Check up update 2: It's been a week, nothing seems to happen. Sometimes i still feel a bit paranoid when i think about it. Reconnected some of my accounts, tried to pirate a game again for a ps3 emu, this time WITH extreme caution. Ran a malwarebyte scan almost twice a day. So far its pretty clear, just a little paranoid.

I downloaded and press the exe filn 2 cmd strips came opp bit nothing realy happen but i eant to check if the are som malware on my pc please help

I downloaded this GTA 6 build cause this guy on telegram sent me a video of him playing it and I paid him $50 to play it and now my pc won’t shut off but I actually don’t know what to do because I have so many files, do I use a usb to recover them before I factory reset or no? He said it’s my cpu but I don’t know I just want to play gta 6 cause I saw a Twitter someone playing it

so i woke up to my discord accounts signed out, checked email to reset password and found out it was disabled for suspicious activity. managed to reset from my phone and login to find out my acc had sent out the mr beast thing.

i unignored all the ppl it sent it to and deleted my messages. as for servers i'm not quite sure just how many it affected. i cleared all those up but my google acc was logged in from a sus location so i quickly reset my password there too. installed malware bytes and it did a quick scan. it found a few trojans, removed them, started a deep scan that's been going on for almost 2 hours. while it was doing that it was blocking connections to a gamezklop. cc through a Msbuild in the .net framework folder. though i ended the process before i could check the file location.

the deep scan had been running for a while and i thought the mr beast thing on discord was about it. (it got sent out like 8 hours ago while i was sleeping)
but just now the same happened on messenger and i don't know what to do. i changed my messenger's password but what else should i do? and how can i go about fixing this?

So I first noticed this a couple weeks ago, where I go to download something and get linked to one of those file hosting sites.

It would give me the exact name of the file/folder but when I download it I get a Python folder that looks like this.

It would be 700mb. The first time I caught htis.

This time I did not and it ran and installed. When windwos defender notified me I allowed the files thinking it was a false positive.

Anyways now I'm pretty sure I'm infected.

here is the screenshots of the 700mb folder it downloads some python thingy.

And the screenshot of this 0l.exe folder i found that im pretty sure is a virus. I ran the .exe of everything here so I'm prob just gonna have to effin reinstall windows at this point right.

I am ashamed of myself for not catching it the 2nd time, and clearly something on my pc is already compromised if I click on links to third party sites and get redirected to this 700mb virus.

Here is an example of the 4gb gta4 mod I was suppose to download https://buzzheavier.com/5njpjfmr8esq

and here is the 700mb folder file I got redirected too nvm. Now that I want to go to it, it won't let me. I wonder if its my chrome infected. How does it allow me to click on a link that hsould direct me to a 4gb file that auto downloads, but instead sends me to a file hosting server and a 700mb file (that I did not catch this time)

Anyways what should I do.

I posted 3 pics. The first showing the folder of the virus i downloaded that pretends to be Python, the second is the 0l folder that is a virus. The third is showing the different file sizes, and how they have similar names. the 4.3gb one is legit, the 700 and 800mb are virus/phython or whatever.

How to remove it. Should i wipe out my entire pc