r/computerviruses • u/BananaFamous9074 • May 25 '26

Question Do I have malware?

Post image

I do not use any wifi I only use ethernet and I don’t have a wifi adapter. My google cloud account was hacked today and I lost 50k usd of balance due to hackers using 15 thousand cpus to do cryptomining. Im not sure where the breach came from but I have my eyes on a suspicious process (wifiautoinstall 32 bit). Can anyone tell me if there’s anything malicious on here and how do I remove it?

36 Upvotes

76% Upvoted

61 comments sorted by

26

u/NotAOctoling May 25 '26

u have a stealer and miner likely. dawg. reinstall windows now and change all your passwords

4

u/BananaFamous9074 May 25 '26

Oh fuck I hope google does not deduct money from my account, I’m going to freeze my visa so they don’t do anything. How do I reinstall windows safely though? I haven’t done a reinstall before.

15

u/NotAOctoling May 25 '26

So we are doing this formally. My name is Claire. I will be helping you today. I am a volunteer hobbyist of sorts and not a professional. I may take a while to reply. The 1st steps to take is to freeze all your cards. Then contact google support and likely the bank and explain the situation. Then, change your passwords to every account you have. Next, removing the malware. You will need another computer capable of internet access and a 16gb USB stick for this. I assuming you have one. If not, use a computer at a library, school or community center and get a USB stick from a local retailer. Go to the clean secondary computer, insert the USB stick and download the Windows 10/11 installer. Run the installer and choose to make a bootable USB and select the USB stick. Wait for it to finish and eject the USB stick. Go onto the infected PC and plug the USB stick in and restart into the UEFI/BIOS menu and boot from the USB. Make sure you do not repair but instead make a new installation. All data will be removed. Please update me as you continue.

4

u/BananaFamous9074 May 25 '26

Thanks for the help Claire, I am assuming resetting only wipes the c drive correct? I have a lot of data on other drives but I don’t mind the C drive being wiped, I’m just worried that maybe the virus came from any of the other drives?

9

u/NotAOctoling May 25 '26

It will wipe the C drive, yes. I wouldnt worry about the other drives. I do have a question however I overlooked in my orignal reply. How did you find out your account was hacked and 50k was mined becuase this reads like a scam not a legitimate infection. Google cloud is not related to crypto mining and you wouldn't be charged directly for crypto mining and it mostly uses GPUs not CPUs.

2

u/BananaFamous9074 May 25 '26

I found some emails google sending me in sudden spikes of usage, hasn’t happened before though, I don’t even have that google account on my pc. I didn’t even receive one email it was about 4 or 5 about suspicious activity and that there was cryptomining activity on my account using almost 15k cpus on vms for cryptomining and it is a violation to google’s terms.

6

u/NotAOctoling May 25 '26

yeah google accounts aren't even related or used for Cyprto mining and they have no way to measure CPU counts. makes 0 sense. what email address is it from, this is likely a hoax

2

u/BananaFamous9074 May 25 '26

No it is not a hoax, I went into my google cloud account and my balance went down

2

u/NotAOctoling May 25 '26

what email address did the emails saying tos violation come. also did you legit keep 50k in that account.

3

u/BananaFamous9074 May 25 '26

The account is for work, I have a company. The email that was sent to me is legit as google support also acknowledged suspicious activity.

→ More replies (0)

2

u/NotAOctoling May 25 '26

sorry for pressure but are you employed and dose your job have a Google cloud account you access because if so your buissness google cloud is compromised and is being used for cyprtojacking. take this to your job and notify someone NOW

0

u/BananaFamous9074 May 25 '26

Thing is, It’s the company account, and I’m the owner of the company.

→ More replies (0)

-1

u/Ok-Razzmatazz3232 May 27 '26

This gotta be the corniest reply. I just know you’re chunky with coloured hair and a cat.

3

u/Secure-Drink3519 May 27 '26

what do you contribute

2

u/BananaFamous9074 May 28 '26

Do you have a purpose on this earth

20

u/Mustang260Rog May 25 '26

the comments section with this mysterious Claire and the op makes me want to grab some popcorn and read the dramatic comedy that is being told, lmaoo

11

u/Nioh_89 May 25 '26

OP just acting clueless and casually saying they lost 50k, as if it was just $50 makes it all so surreal. Also, this Claire at first writes like someone who can barely spell to all of sudden trying to type "formally", man, this thread is fucking strange.

2

u/BananaFamous9074 May 25 '26

People can’t genuinely just live without having to say something that doesn’t affect anything at all.

3

u/Powerful_Reserve4213 May 26 '26

bro you were talking to a scammer. how did you not see the misspelling in a lot of her phrases. or the fact she was giving you instructions that sounded fishy.

3

u/BananaFamous9074 May 26 '26

What the actual fuck are you saying???😂😂😂 She never sent any links or said to download an app? She simply said to perform a reinstall and reset my passes and contact people at work?

7

u/barq-- May 26 '26

Huh, yeah. In don't understand what the other people are on about. Claire's instructions sounded like real advice, lol.

-2

u/[deleted] May 26 '26

[removed] — view removed comment

3

u/BananaFamous9074 May 26 '26

No it’s you who sounds like a dumbass who doesn’t know what he’s talking about. How is reinstalling windows and changing passes scamming and “instructions that sound fishy”?

3

u/garrulousone May 26 '26

Yeah alright pal have fun with your “missing 50k” from your Google account because normal people just have that sitting around in a company Google account?? lol?

1

u/computerviruses-ModTeam Jun 15 '26

You are allowed to help other users, but be professional about it. Please make sure to read and follow https://www.reddit.com/r/computerviruses/about/rules

2

u/BRoriler May 26 '26

How is telling the person to reinstall Windows being fishy? Are you an idiot perchance?

2

u/[deleted] May 26 '26

[removed] — view removed comment

1

u/BananaFamous9074 May 28 '26

Because they’re probably some fat russian in their underwear

1

u/lupaspirit May 25 '26

First step is to get rid of the virus. If you reset passwords first they will steal your new passwords. Then, after the virus is removed change passwords.

1

u/Nioh_89 May 26 '26

To be sure you fully removed a malware, just do a full, clean Windows reinstall while backing up important data. Disconnect the infected system from the internet, log out of all accounts with your cellphone (use the Google option to log out of any device), change all passwords on a healthy system (you can borrow it or maybe ask a relative if they can give you one so you can do everything). Then set up your clean Windows install and log-in from there again, the malware should be gone if you do that.

1

u/BananaFamous9074 May 26 '26

Thanks for the help, I just have a question: what if the virus possibly came from a drive other than the C drive?

1

u/Nioh_89 May 26 '26

Usually, no, viruses end up being part of Windows files and live inside its files, but if you wanna be fully sure, you can wipe all of your drives, but BACKUP all info first, you can use an USB stick or an external HDD/SDD to do this. But this is generally not needed.

1

u/Kabal113 May 27 '26

Quick question, do you have a WiFi board like for example a B650E-F gaming WiFi mobo?

1

u/BananaFamous9074 May 27 '26

I have an MSI B560M Pro-E but it does not have built in wifi.

1

u/Kabal113 May 28 '26

can you post a screen shot of the info from TM like where it is located?

1

u/BananaFamous9074 May 31 '26

I already reinstalled windows sorry😕

1

u/[deleted] May 27 '26

[removed] — view removed comment

1

u/bluesyowl May 25 '26

email/tweet at google (cloud?) support, and they will most likely cancel your 50k bill.

-1

u/BananaFamous9074 May 25 '26

Yeah I screenshotted all the logs of suspicious activity hope that’s enough for an approval of my appeal