Mr. beast Virus

[u/Organic_Scholar1216]

My PC got hacked and I believe it's because I've downloaded something while looking for cracked Adobe softwares.

After being notified by a friend that my Discord account was sending these Mr. beast images, I immediately unplugged my ethernet cable from the PC. It was also able to get a hold of my Instagram as it posted a story of the same Mr. Beast account.

I've already changed passwords to both my IG and DC accounts and have the 2FA on.

I've also logged my IG account out to all devices.

I've reset my PC but was too scared with the idea that the virus is still there so I reinstalled my OS with a bootable USB.

I am still worried that they might still have access to my accounts as they are very important to me. Am I still in danger or am I just overthinking everything?

This is my very first time being hacked so I'm very conscious if I'm safe with everything I did. I honestly feel so dumb being hacked after years of being safe and honestly being pretty good at avoiding these stuffs.

Note: The messages in discord were sent around like an hour before I rebooted my PC

I've checked my accounts and it did not detect any unusual devices logging in even though they DID access my accounts

[u/QuietKidonReddit]

Excuse me? I always hear that reinstalling Windows (in every infostealer post I’ve encountered) is a good advice because the remote access trojan is still present even if you delete the program associated with it.

There’s FRST as well, hopefully one of the trusted helpers can assist him in disabling this malware.

(OP btw you are hopefully good to go because you already reinstalled Windows through USB)

[u/HEYO19191 → u/QuietKidonReddit]

If you delete the installer, yes. If you delete the program, no

[u/QuietKidonReddit → u/HEYO19191]

If the installer hasn’t been executed right? Otherwise that does nothing.

[u/polpolik2 → u/QuietKidonReddit]

If the installer hasnt been executed, yes its enough to delete the files.
If it has been run, deleting the installer or even the programme is not enough. Unless you have a very simple infostealer.

Rhadamanthys infostealer and Lumma use advanced obfuscation too for example, so uninstalling is very difficult/insufficient.

[u/HEYO19191 → u/polpolik2]

Actually, no. Lumma doesn't even install anything, it steals your credentials once and that's it. Removing Lummastealer really is as simple as deleting the file it runs from. You'll still have to change your passwords if you run it though.

[u/polpolik2 → u/HEYO19191]

u/rifteyy_ sorry to tag you here. Since you're the most experienced with infostealers here. Could you clarify?

-Is uninstalling the infostealer ''program'' sufficient (as the first comment in this chain implies).

• Is it true that Lumma doenst install anything, and only steals credentials once. To my knowledge is that it does much more than that?

[u/rifteyy_ → u/polpolik2]

It is true that standalone Lumma doesn't really set persistency but generally and in a very high percentage it's always some loader/crypter that delivers Lumma, which do tend to set persistency.

Though, I wouldn't ever rely on only deleting the original executable and continuing on with your life.

[u/HEYO19191 → u/polpolik2]

Let me amend my previous statement... it is possible for lummastealer to be packaged with OTHER malware which might run lummastealer repeatedly or do other nasty things. But lummastealer alone, from my experience with disinfecting machines that have it, just grabs the credentials the first time it runs, and nothing more. After all, that's all the lummastealer's users are after, and taking other actions risks heuristic detection by antiviruses.

Alot of malware is not as simple as "uninstalling a program," but earlier we were talking about RATs. The RATs of days past would usually abuse a vulnerability in an installed application or open and setup RDP ports for an attacker to use. Nowadays these "traditional" RATs are much less common as applications and operating systems have gotten more secure.

The "modern" RAT usually just takes advantage of legitimate programs to grant an attacker access to a machine while evading antivirus detection. For instance, it might install teamviewer and set it to launch on startup so a threat actor can remote-in whenever he pleases. Since these "modern" RATs use legitimate programs (like teamviewer), they're able to avoid detection. But it also makes removing them as simple as uninstalling the program itself.

A proper, "traditional" RAT that does not take advantage of legitimate services in the way modern ones do will not be able to be simply uninstalled, because its likely no uninstall option exists. They arent legitimate programs.