So, this has been a problem for a bit, and I'm not exactly planning on solving it, because, from what I understand, as long as I don't download any actual viruses, I should be fine, but still, I do want to know what I am capable of doing to solve this situation in case a time where I need to comes.

So, I have the winring0 thing on my laptop, from what I understand, it basically allows programs full access to my laptop. But you see, here's a thing, a program called Gigabyte Control Center relies on it to function from what I understand, or at least that's what I think the case is, I'm not entirely sure. The program basically allows you to change some fan settings and stuff, it isn't anything special.

Still, this winring0 thing does bring me some slight concern, and I would like to know what to do in case a time comes when I DO need to remove it.

Completed a USB Windows redownload
Around 24h after original attack, no sign of hacker/damage yet

Steps I took:

1. Followed https://www.reddit.com/r/computerviruses/s/nqxFG2rinj
2. Removed rootkit in programs in settings, any files pertaining to virus to my best ability with malwarebytes, removed what i think was grabbing my info periodically on task scheduler
3. Changed passwords and logged out of important accounts on separate laptop
4. Ported everything over and important files (while connected to internet) to separate drive
5. USB redownload, following steps of https://www.reddit.com/r/computerviruses/s/CppM2SSNB4 except I did not reset my pc before the download (not sure if need to?)
6. Changed passwords again and logged out of all accounts including not so important accounts, including on phone and separate laptop used to change the passwords
7. Have yet to port over my data from the separate drive

Questions:

Does it infect external drives or just C: drive? I had an external SSD connected when attacked

Where is the virus truly located? I have files moved over onto my new Windows installation from AppData and I want to know if I have accidentally brought it over. From my own investigations, one of the scripts are located in C:\Users\User\AppData\Local\Microsoft\Windows\Caches\PaymentReconciler\analytics_aea4.cmd

If I was logged into my Whatsapp web and Telegram web during the attack, are they safe and how do I know if they are safe?

If I had card details saved on Steam, but not Google, is it also stolen?

I had sensitive information (ID photo, but not photo of my ID itself, a picture of my passport on my PC, and my address saved on Google Autofill) What steps do I take to stay safe?

I love emulation and downloading Roms but this is my consequence for not trusting my gut and listening to recommendations on where to find them. I downloaded and installed a RenPy virus after a quick installation of legends z-a and I couldn’t get my Eden emulator to recognize the game and after inspection of the files there was a setup .Exe link, you know how it goes.

After a quick search I found out about RenPy and quickly disconnected from internet ran the scans offline scans and what not but now what? I don’t really want to reinstall windows and if I have too I have no idea how to do that. I have changed my passwords and everything has 2fa that I can think of but I am not sure if I’ve ever used my credit cards and what not on this PC because it’s pretty new (5-6 months.)

Is there anyone who can guide me through some ease of mind for my setup so I don’t have to reinstall windows and if I do maybe give me a quick hand with that also?

Thanks y’all sorry for being a lurker all these years 🫣
(Also I was going to add pics to this but I don’t know how)

​

Hi everyone. I fell realy dump and afraid right now.

My PC was recently compromised after downloading a malicious executable masquerading as a Sony Vegas Pro installer (vegas220.exe located in C:\ProgramData\com_usr_node_v9).

Here is what happened:

Steam Account Hijacked: My Steam account email address was changed without my authorization (no email notification received in my inbox prior to the change).

Malware Detected:

Malwarebytes flagged several .BAT scripts as Trojan.RenplyLoader.BAT, a process detected via AI (Malware.AI.1298616306), and blocked outbound connections to a Command & Control (C2) server located in Germany.

An error message popped up showing that OvSupervisor.exe was actively running in C:\ProgramData\com_usr_node_v9\.

Kaspersky Virus Removal Tool (KVRT) detected a Trojan.Win32.Hosts2.gen infection inside C:\Windows\System32\drivers\etc\hosts.

Actions taken so far:

-Disconet from internet.

-All detected items in Malwarebytes and KVRT were quarantined/cured (including the hijacked hosts file).

-Still have the malicious folder in ProgramData don't know if I can remove it.

-Changed my primary email password and enabled 2FA from an uncompromised mobile device (using cellular data).

-Submitted a recovery ticket to Steam Support with proof of ownership.

My questions:

What can I do more ?

How to be sure that all risk is delete ?

Thanks

Downloaded it. Ran it. Deleted it after 5 minutes after I realised what was happening.

Posting around 6 hours after it happened, nothing has happened to my PC or accounts yet, not even a security warning.

Changed all my passwords and ran several malwarebytes and windows defender offline scans to identify and remove all found instances of the virus. Removed the rootkit from my PC, is there still a chance I am infected?

Some posts recommend reinstalling my OS but i am not too keen on it yet.

2 days ago i downloaded a .exe file (im so dumb ik) then the next day i woke up my discord sending mrbeast scams and my tiktok posted russian comment. I discovered suspicious device on my tiktok which then i changed password on my phone and log out all sessions. Did the same on discord (tho there was no other devices log ins) and ALL of my accounts (gmail, fb, ig)

The discord and tiktok breach happened for 1 hr.

I can still access my accounts on that day and there were no other log ins except from my devices.

I also do MFA for all of my accounts then reinstall windows with cloud. Now, i keep checking suspicious log ins on ALL of my accounts and there are nothing suspicious, only my phone and ipad. There are also no other suspicious activities.

Am i safe now from the malware? I keep overthinking since i only do cloud reinstall. And i also saw reddit posts that they somehow bypasses mfa which makes me worried. I keep scanning it from time to time with malwarebytes and no threats detected. Is there still a possibility that the hacker will breach my discord and tiktok again? Or even my other account?

edited: i already reinstall windows w usb as what you guys recommended. thank you

2 hours ago my IG and discord accounts both got hacked even though I have 2fa enabled on both and started sending dms to all my contacts by screenshots of the classic Mr beast giveaway scam, the thing is I never leaked my credentials nor put it on fishy websites, never downloaded suspicious software or pirated games....

I immediately logged out all my devices to clear the authenticated logged in sessions( there weren't any new devices or new suspicious logins detected, which makes sense on why I didn't get the 2fa notifications) currently running deep scan on my laptop after disconnecting it from the internet (not sure if the login sessions could be hacked on phone, but highly doubt it)

My main question is do I really need to change all my passwords for all logged in accounts on my laptop, or that was just a session hijack and the hacker didn't really get a grasp of my passwords? Also will I need to install new windows on my laptop?

I really need help on this because this laptop is my only resource for studying and I need to get this issue fixed ASAP. I'm not interested in a clean wipe now, I need to keep as much as I can. I tried downloading a notion ai pro note taking app and got this renpy virus instead (it opened and closed two command prompts).

I did not do much research. I scanned with Malwarebytes + Hitman Pro and it quarantined a 12 or so files and I removed them. I cleared my browsers, removed the cookies. I just want to know how I can fix as quickly as possible since I need to go back to turning on WiFi for my homework. I already did all the 2FA stuff.

cleaned out a browser redirect script on my sister's laptop last night that hijacked her default search engine after she downloaded an ad-riddled pdf converter. tbh we have four devices in the house across laptops and phones, and basic native tools did nothing because the extension was technically approved by the user. i need active web protection that intercepts dodgy redirect scripts, scam detection for fake update notifications, and identity monitoring that flags leaked credentials online. paying separately for a standalone tunnel, password vault, and mobile security across everyone's hardware is getting messy. i have been looking at packages like bitdefender and mcafee to bundle network defense, mobile security, and bank transaction and credit score tracking under a single plan. for anyone who routinely fixes junkware on family laptops, what do you reckon is the best antivirus and vpn for multiple devices that stops shady scripts without constantly bugging people with false alarms?

Dunno if this is the right sub to send this, please correct me if I'm wrong.

I'm currently away from my PC, I'll share any files that might help once I'm back to it (hopefully tomorrow).

Downloaded a malicious program in my PC yesterday, and I believe it ran a Python code right after. I "apparently" erased all files originalidade from it.

A while after that, all of my social media (Instagram, Facebook, Discord) started sending Mrbeast SCAM advertisement to my contacts, allegedly talking about how I'd won lots of money quickly by doing something online.

I immediatelly changed all passwords to e-mails I could remember, but I'm wondering if they'll still have access to my accounts through other means whatever they may be, as seen when they tried to long into my Riot ans Steam accounts with no success, although thwy successfully changed my LinkedIn profile password (already recovered the account). Is there a surefire way I can fix everything?

I've changed all passwords of my knowledge, could they still get into my accounts through services I don't remember? As in, even after having altered my google accounts passwords, had they done the log-in beforehand, would they be capable of keeping the session in my account and eventually using it to take back access of everything?

I'm planning on doing a windows fresh-install to hopefully wipe anything malicious that might be left.

Tf do I do now??? Is there anything I'm missing???

I got a info stealer a few days ago and changed my passwords and even did a windows reinstall reset I chose remove everything and I can’t remember if I chose local reinstall or a cloud download if I did local could the info stealer still be on my pc and if I did a cloud download can it still be on my pc.

Downlaoded and ran the setup rougly around 5 a.m OCT 10, but I didn't notice it immediately having went to sleep and at around 2 p.m went into lockdown cutting off ethernet and online connection then used a different clean device inchanging all my passwords, enabling 2fa and removing/logging out all sessions i could remember or think of. Ran malwarebytes and windows defender deep scans, but only malware bytes found any including Pavind loaders and the renpy infostealer files with its scans. I tried further scans but it keeps hanging or stopping midway with no further progress even for hours on end forcing me to abort or cancel the scan which makes it hang and i have to force manual shutdown.

Current observations so far is that only my discord account got compromised immediately with it sending mrbeast scams to my friendslist but suprisingly not all my discord servers. Other than that no other account got breached thus far nor have i noticed anything off with my system yet. There were a few new installations on that date like nvidia graphics control or tp-link, so i promply uninstalled everything installed that date. Nothing suspiscious in startup apps/tasks in task manager that i could tell. As for scheduled tasks i didnt notice anything out of the ordinary but maybe I just couldn't tell.

I'm open to reinstalling my main system drive and OS and have already prepared a USB with the media creation tool, but would rather not get my other drives involved if at all possible. My infected PC is still offline to be safe. And if it at all matters, i downloaded the zip of the renpy infostealer into drive D, extracted it into and ran from drive J.

hello everyone! please help me in my long search for an old YouTube video featuring a windows 7 or Vista aggresive virus. There was a song playing in it called 'Why We Lose' from NCS. Video is old, about 7-10 years old. I can't find it anymore on youtube. Does anybody here know about it? Thanks. It meant a lot to me, I watched it often when I was a kid haha

Hi guys, I just got my first computer. I use it for mainly editing and gaming, sometimes browsing the web. What antivirus would be best to use? Windows 11. Ive read that McAfee is trash. Is windows defender sufficient or do I need more? Thanks in advance.

I found "UnInstDaemon" enabled in the Startup tab of Task Manager (I disabled it, along with the process shown in the details). The file is located here:
:\Users\username\AppData\Local\Temp\bwpabef17d1-d05f-4c96-bd59-05b25c37fa8e

VirusTotal and Microsoft Defender didn't find any issues with the file. The digital signature looks legit, although seeing "Microsoft Corp." as the publisher in the Startup tab looks suspicious.

This is a clean, new Windows 10 system with no shady software installed, so I have no idea where this file came from.

Link to the VirusTotal scan:
https://www.virustotal.com/gui/file/a8c7a28ae159b681a3f682db32433eaf1846059e1ed5e1bcf7b9ab1027bd6454

There was a specific malware that I'm struggling to find. There was a clean version of it to where you could just run the program to view the visuals but not have the actual dangerous payloads execute on your machine.

I don't remember what it was called, it started with either a Z, Q, or C in the name and IIRC, it did the following (but not limited to these):

- A visual payload where it either filled the screen with squares, diamonds, etc. that swirled over and over creating this visual effect where the pixels where melting (?)

- Had colorful text with the name of the malware or the creator flashing everywhere on the screen in different colors

- Had loud sounds during these payloads

I used to have it before but I don't, and google/Reddit/YouTube isn't being exactly helpful because I can only go with my memory and as time continues I forget more details.

I'm not sure if this was the right place to ask but I would be more than appreciative if anyone had any idea of what this malware is called or if I could be re-directed to the correct subreddit in my hunt. Thanks! :)

Would like some assistance with clearing out the malware without having to perform a clean install as I have deadlines that can't afford to be delayed. Already added 2FA/MFA, cleared browser caches/data, and changed passwords, on top of logging out of all my accounts and active sessions.

Windows Defender came out clean, quarantined any threats detected by Malwarebytes.

EDIT: keywords:

lush-scanner

I mistyped a URL and even though the site looked sketchy af i was being stupid and accidentally downloaded something. Malwarebytes blocked the site right after and the download says it was cancelled by chrome (as seen in the image). Task manager looks fine, malware bytes and windows defender was clear, so do i need to reinstall windows or something or am i good?

I was just curious to know because I would've like to watch movies/tv show from monitor and what I could do is screen mirroring my phone to my pc. Instead of using my pc directly. Even if I had any sort of adblock or anything in my phone and pc, would it still have the possibility to be infected?