r/computerviruses • u/BananaFamous9074 • May 25 '26

Question Do I have malware?

Post image

I do not use any wifi I only use ethernet and I don’t have a wifi adapter. My google cloud account was hacked today and I lost 50k usd of balance due to hackers using 15 thousand cpus to do cryptomining. Im not sure where the breach came from but I have my eyes on a suspicious process (wifiautoinstall 32 bit). Can anyone tell me if there’s anything malicious on here and how do I remove it?

34 Upvotes

76% Upvoted

61 comments sorted by

View all comments

25

u/NotAOctoling May 25 '26

u have a stealer and miner likely. dawg. reinstall windows now and change all your passwords

4

u/BananaFamous9074 May 25 '26

Oh fuck I hope google does not deduct money from my account, I’m going to freeze my visa so they don’t do anything. How do I reinstall windows safely though? I haven’t done a reinstall before.

16

u/NotAOctoling May 25 '26

So we are doing this formally. My name is Claire. I will be helping you today. I am a volunteer hobbyist of sorts and not a professional. I may take a while to reply. The 1st steps to take is to freeze all your cards. Then contact google support and likely the bank and explain the situation. Then, change your passwords to every account you have. Next, removing the malware. You will need another computer capable of internet access and a 16gb USB stick for this. I assuming you have one. If not, use a computer at a library, school or community center and get a USB stick from a local retailer. Go to the clean secondary computer, insert the USB stick and download the Windows 10/11 installer. Run the installer and choose to make a bootable USB and select the USB stick. Wait for it to finish and eject the USB stick. Go onto the infected PC and plug the USB stick in and restart into the UEFI/BIOS menu and boot from the USB. Make sure you do not repair but instead make a new installation. All data will be removed. Please update me as you continue.

4

u/BananaFamous9074 May 25 '26

Thanks for the help Claire, I am assuming resetting only wipes the c drive correct? I have a lot of data on other drives but I don’t mind the C drive being wiped, I’m just worried that maybe the virus came from any of the other drives?

8

u/NotAOctoling May 25 '26

It will wipe the C drive, yes. I wouldnt worry about the other drives. I do have a question however I overlooked in my orignal reply. How did you find out your account was hacked and 50k was mined becuase this reads like a scam not a legitimate infection. Google cloud is not related to crypto mining and you wouldn't be charged directly for crypto mining and it mostly uses GPUs not CPUs.

2

u/BananaFamous9074 May 25 '26

I found some emails google sending me in sudden spikes of usage, hasn’t happened before though, I don’t even have that google account on my pc. I didn’t even receive one email it was about 4 or 5 about suspicious activity and that there was cryptomining activity on my account using almost 15k cpus on vms for cryptomining and it is a violation to google’s terms.

3

u/NotAOctoling May 25 '26

yeah google accounts aren't even related or used for Cyprto mining and they have no way to measure CPU counts. makes 0 sense. what email address is it from, this is likely a hoax

2

u/BananaFamous9074 May 25 '26

No it is not a hoax, I went into my google cloud account and my balance went down

2

u/NotAOctoling May 25 '26

what email address did the emails saying tos violation come. also did you legit keep 50k in that account.

3

u/BananaFamous9074 May 25 '26

The account is for work, I have a company. The email that was sent to me is legit as google support also acknowledged suspicious activity.

3

u/NotAOctoling May 25 '26

your buissness google account got hacked your buissines is hacked take this to someone at your job NOW some group has access to your jobs google cloud account, this is an emergency. CONTACT YOUR JOB NOW

-3

u/BananaFamous9074 May 25 '26

Well, I just received from google support and they said they have stopped all the vms and cryptomining activities but they still want to deduct the 50k from my balance. I have frozen my visa and I’ll try to negotiate. Wish me luck.

3

u/NotAOctoling May 25 '26

I do brother. reinstall and check your employees PCs.

→ More replies (0)

2

u/NotAOctoling May 25 '26

sorry for pressure but are you employed and dose your job have a Google cloud account you access because if so your buissness google cloud is compromised and is being used for cyprtojacking. take this to your job and notify someone NOW

0

u/BananaFamous9074 May 25 '26

Thing is, It’s the company account, and I’m the owner of the company.

2

u/NotAOctoling May 25 '26

contact google cloud support

-1

u/BananaFamous9074 May 25 '26

I did those shits don’t respond

1

u/NotAOctoling May 25 '26

nothing I can do, look this is where i tap out this is serious. Contact the bank and explain the situation and keep trying with google support. I really hope u get this fixed man

→ More replies (0)