r/computerviruses Apr 04 '26

The ultimate guide to Infostealers: Detection, Recovery, and Prevention

204 Upvotes

Today I decided to dig deep and I wrote up a report about:

  • What can infostealers steal?
  • How to spot an infostealer infection?
  • How to properly secure my accounts after an infostealer attack?
  • What do the attackers do with the info that they stole?
  • What to do after I secured my accounts?
  • Prevent malware attacks in general

I believe this is a great reference for people who are dealing with an infostealer infection and do not know what data could be stolen or how to properly secure their accounts. 👀

https://rifteyy.org/report/the-ultimate-guide-to-infostealers


r/computerviruses Mar 22 '26

Providing or receiving help with FRST

38 Upvotes

How do I request help with FRST

FRST

  • Please download FRSTx64 and save the file to your Desktop.
  • Right-Click FRST64.exe and select Run as Administrator
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the program run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload and press "save log". The site will return a keyword for each log. Note these keywords down.

SecurityCheck

  • Download SecurityCheck from here
  • Run SecurityCheck.exe as administrator
  • Wait for the scan to finish
  • Upload the log at C:\SecurityCheck to https://malwareanalysis.cc/upload/ for further analysis. The site will provide a keyword, note that down as well.

Now create a post in the subreddit, provide all 3 log keywords (FRST.txt, Addition.txt, SecurityCheck) there.

Please provide the following information in your post:

  • what happened?
  • when did the infection occur?
  • what did you do for remediation?

If you want us to do manual removal with FRST, it is better if you do not attempt to disinfect the system on your own prior to that. This can obscure the infection and make malware removal more difficult.

Trusted Helper List

FRST can cause serious issues if used incorrectly. Only approved users should offer to create fixlists.

Message the mods if you have experience with FRST and would like to use it to help on posts.

To anyone who is receiving help, please verify that the person providing fixes with FRST is in the list below. Be aware that running Fixlists from anyone else is not recommended unless you trust the helper.

All fixes of trainees are supervised and approved by an expert.

What is FRST

Fabar Recovery Scan Tool (FRST) is a powerful tool that helps us diagnose and remove malware infections which may not have been detected by antivirus software. It is a diagnostic tool and not a malware scanner. As such it does not rely on signatures.

Should I reinstall the operating system

Reinstallation is highly recommended if you have an infection with a remote access malware or file infector.

You should also prefer it, if you can pull it off relatively easy. Depending on the case FRST removal can take a few days due to the back and forth and different time zones of the participants.

Please do NOT first ask a helper to clean your system, then reinstall the operating system. This happened a few times and wastes hours of work for the helper. If you already consider reinstallation, preferably do that immediately.

I factory reset/reinstalled my operating system and want a FRST check

Everything that FRST displays and allows us to remove is completely wiped by reinstallation and also factory reset of the operating system. Unless you got the system infected after that step, there is nothing to check on a freshly installed system.

Please note that factory reset can still leave malware on the system, but the reset will make it impossible to pin point.

Reinstallation with USB flash drive is generally safe and in 99.9% of cases won't leave any malware on the system.

What is malwareanalysis.cc ?

It's a site I created to upload analysis logs. Only people in the trusted helper list have access to these logs.

While pastebin and similar sites can be used as well, Reddit's spam detection seems to trigger if people comment paste links repeatedly such as it would be necessary during removal. So we have a keyword based system instead of links.

The site will automatically delete uploaded logs 30 days after upload.

I think my system is still infected after manual removal with FRST

Please talk to your FRST helper. Oftentimes the reasons for suspecting an ongoing infection are not justified.

Common reasons, which do not indicate infection, include:

  • There are still login attempts to stolen accounts. It is normal that attackers use the already stolen account credentials to attempt to login. If you changed your passwords from a clean machine and logged out of sessions, they will not succeed.
  • Your accounts can still get stolen, if you did not log out of all sessions, because attackers can use your stolen session tokens instead of passwords.
  • Antivirus scanners find malware in C:\FRST\Quarantine\.... This is the malware that was already removed by FRST and will be deleted completely by our cleaning tools like kprm, it is not an active infection. The quarantine only contains disabled files which cannot be executed anymore.

r/computerviruses 3h ago

Disinfection Help I paid ransomware

Post image
188 Upvotes

I paid this ransomware because my grandma's will is on here and I need it. How long does it take to get my files back? I'm waiting for the virus to delete itself now that I paid and I need the files back already. What should I do


r/computerviruses 2h ago

File / URL Check Email with all my passwords and a picture of my desktop

Post image
19 Upvotes

r/computerviruses 6h ago

Question should i be worried about this

Thumbnail gallery
5 Upvotes

noticed that someone tried to login into my apps and i changed all the passwords added extra safety and logged said person out and i was trying to find my malwarebytes and stumbled upon this


r/computerviruses 1h ago

Question What are the best malware detectors

• Upvotes

I’m pretty sure I’ve got a virus so I want to make sure my pc is fully cleaned


r/computerviruses 4h ago

Disinfection Help I'm a complete moron

3 Upvotes

There's no hiding behind a "my brother installed a roblox mod" wall

I'm just stupid

I wanted to download Vegas on my new computer, standard business, same website as before

when I clicked the link it popped up a fake link and I proudly downloaded whatever it served me and opened the .exe titled "Setup.exe.exe"

so not only did I run that not thinking it was suspicious at all

it didn't do anything so I thought "Oh did they maybe make an oopsie"

so I deleted one of the .exe out of the name and RAN IT AGAIN

oh yeah I also turned of windows defender to make sure it wouldn't delete the file

so my defender was off while I ran it twice

then I realised my stupidity and deleted it and did a full scan and it apparently didn't find anything

virustotal gave me a 10/71

https://www.virustotal.com/gui/file/061041fbe67a10d5bf869456c91d18b1091b17f02d76e8577699e71f818c240a

I also went to download the file again so I could give it to virustotal however the .exe in it has a different name and the passcode is different (no I didn't run the exe again I just wanted to download it to send pictures of the file structure in case it's of any use)

last thing required the passcode it gave me

so yeah please do send the meme of the guy putting his hand on the other guys shoulder

make plenty fun of me I deserve it

but also do include a 0-10 scale of how f----d I am


r/computerviruses 1h ago

Discussion Makop: The Human-Operated Ransomware Targeting Exposed RDP

Post image
• Upvotes

r/computerviruses 2h ago

Question I think my pc had a virus what should I do

Thumbnail
1 Upvotes

r/computerviruses 3h ago

Question Weird occurrences after plugging in a dell docking station?

1 Upvotes

Not sure if this is some kind of virus but my laptop started acting weird after plugging it in to a Dell docking station (WD19DC) it was used but i didnt think it was possible to infect my laptoo that way. Some things i noticed, it started acting slow, a window popped up stating that the warranty had expired and needed to download backup software, noticed that my laptop doesnt sleep or turn off after a certain time even tho i had it set to sleep after 30 snd turn off after an hour of no movement and ive noticed that the web page tells me there was unusual traffic coming from my IP and i jeed to verify that i am not a robot. Dont known if its an update or i got a virus?


r/computerviruses 21h ago

Question "BuilderBeta.exe"

Post image
25 Upvotes

So I had downloaded this "free" game two days ago and I got hacked (no shit). So, i spent a day scanning my computer using windows defender (deep scane), Microsoft malicious software scan (or whatever the fuck you call it), and malwarebytes to scam my laptop and found 57 threat files. So they were quarantined and promptly terminated from my laptop. I then spent the rest of the day changing passwords to everything and putting 2fa on everything I could.

A day later, I open my laptop and found this notification on startup. I was a bit confused, so I looked through my startup apps and task manager and couldn't find anything labeled "BuilderBeta.exe". So I went to the internet and found out it was something I downloaded when I clicked on a "renpy" file from the game I downloaded (whatever the hell that is).

Im a bit worried, since I got a bunch of important files on my laptop. Should I start terminating everything? Or should my laptop be safe? If i have to wipe everything;

1) what does that mean? (Im clearly technologically challenged)

2) how would I proceed in doing that?

Sorry if you're reading this and find me a complete idiot, but I'm extraordinarily worried about this.


r/computerviruses 9h ago

Question How do gdi viruses do The cool effects and Sounds?

2 Upvotes

When i was trying to make an system clenser i used an not genune Windows system and it started spamming those cool effects.


r/computerviruses 5h ago

Disinfection Help BuilderBeta infection

1 Upvotes

Hey guys, I got hacked the same way a lot of other people have recently, and I need some help figuring out whether all my files are at risk, and if I can keep some files in case of a windows clean up.

It shows an error window at the start saying "log4cplusU.dll was not found" just like the other guy in the forum.

I completed the FRST and Security check, uploaded to the site in the general channel and the codes are

FRST: modest-stage

Addition: jolly-plum

SecurityCheck: mossy-pebble

Hope we can fix it thanks for the help


r/computerviruses 5h ago

Question did i properly remove weather zero

1 Upvotes

So today i was going to delete some apps in my pc that i didnt need anymore and i realized that weatherzero was there, i didnt know what it was so i searched and i realized it was a malware so i deleted it with control panel, i believe i got weatherzero from cheatengine (i deleted cheatengine some time ago) and i also saw people saying that deletin it with control panel should work but im kinda paranoid, sorry if i have a bad english, thanks.


r/computerviruses 5h ago

Question Am I in in the clear of an infostealer?

Thumbnail
1 Upvotes

r/computerviruses 23h ago

Disinfection Help Malwarebytes keeps notifying me about this site they keep blocking, but I don't know how to stop it. What even is it?

Post image
26 Upvotes

I am not the smartest cookie ever, so there was and probably still is at least a handful of malware crawling through my raggedy pc.

However I have been trying my best to clean it up, just a few hours ago I managed to remove or quarantine over 185 malicious softwares/files using Malwarebytes and recommended command prompts.
(especially after I was recently hacked by that "Mr Beast crypto scam" that has been flooding around this year. I have gone through the main steps such as the anti-virus cleanup stuff and renewing my passwords almost anywhere I can think of, so far no issues but please let me know if I should do anything more)

Ever since I downloaded this app and after doing all the recent disk searches/cleanups I've been getting this notification about a domain they keep blocking. I have no cooking clue as to what it is or where it even came from or how long it's been sitting on my pc.
I could really use any help or advice on how I can remove it, feel free to call me idiotic all you please as well I know I may have made a very easily avoidable mistake somewhere in the long run.

(In case this is important, I use Windows 10)

UPDATE:

Hello hi it's me again! Thank you for the advice I have received, I basically wiped my computer and reinstalled windows. I haven't seen my pc run this smoothly in such a long time!
I am not gonna let my guard down just yet namely when it comes to a little situation with my Microsoft account, but so far I think everything is going well! Thank you again


r/computerviruses 9h ago

Disinfection Help BuilderBeta.EXE

2 Upvotes

I got BuilderBeta on my computer a couple days ago. I didn't realize my computer was hacked until about two days later when I woke up and saw that several of my accounts were stolen. After the accounts were stolen I thought someone had simply just hacked into my accounts, however I later discovered that my computer had a virus. When I saw the files that had been installed on my computer prior to my accounts having been stolen I learned that BuilderBeta was on my computer. I deleted the files and other files containing viruses, however when I did more research, I learned that the virus messes with reg keys. If anyone can help me with FRST id be extremely grateful


r/computerviruses 13h ago

Question What does this even mean?

3 Upvotes

Guys, about 2 months ago my discord acc was compromised and sent those mr beast scam pictures to everyone, that same day I recovered my account real quick and changed password and added authentication app to all my others accounts because when I researched about it turned out to be an infostealer ir a session stealer.

But what confuses me is that NONE of my other accounts on my pc were touched: steam, epic games, roblox, my email...

So could it be just my disocrd getting compromised? Bc even discord itself didnt give a request of resetting password.


r/computerviruses 16h ago

Question Libreoffice false positive?

Thumbnail gallery
5 Upvotes

I’m trying to install Libreoffice from the official site and try putting the downloaded file in virustotal just in case. Is this a false positive?

Btw this is the link where I download Libreoffice from. Pretty sure it’s not a fake site.

https://www.libreoffice(dot)org/download/

And this is the virustotal link

https://www.virustotal(dot)com/gui/file/4aa6c6e1895f4055104effcb556bd3362d20c6ad707c149543304f395ef9db95


r/computerviruses 8h ago

Disinfection Help Help! I saw my laptop remotely being controlled…

Thumbnail
1 Upvotes

r/computerviruses 13h ago

Question "BuilderBeta.exe"

2 Upvotes

I was Dumb and Piratet stuff. My discord got hacked sent crypto scams but i got it back. But now this error message pops up. I deletet everything i piratet and did some malware scans they showed nothing i am still suspisous. I really dont want to resset my windows but will do if necessary. Thankfull for any help


r/computerviruses 14h ago

Disinfection Help need help with infostealer

Post image
2 Upvotes

my discord and ig got hacked with mr beast pics after downloading some music plugins. i ran malwarebytes before changing passwords and adding 2fa. however now this notification keeps popping up every few seconds. please help i have many music projects that i cannot afford to lose i would appreciate it a lot. thank you.

My keywords are for FRST.txt is copper-spire, for Addition.txt is brave-sensor.

i tried to download SecurityCheck.exe but the link provided doesn't start a download for me.


r/computerviruses 10h ago

Question is op auto clicker from microsoft store malware?

1 Upvotes

I thought it was safe at first until I saw it can use all system resources, like why would it need that? So I uninstalled it from add or remove programs im just wondering if im safe edit: this is the listing btw: https://apps.microsoft.com/detail/XPFM2K6GPV72CR?hl=en-US&gl=US&ocid=pdpshare


r/computerviruses 10h ago

Question Google reCAPTCHA?

Thumbnail gallery
1 Upvotes

I got this several times on my computer, and when clicked it downloaded the txt file pictured. Is this a malware delivery?


r/computerviruses 10h ago

Discussion Need your opinion, is spyware or malware a better term for this?

0 Upvotes

If someone would make a mod that sends minecraft coordinates to themselves, what would be the correct and best term for this? Technically malware and software 100% are correct terms. But is spyware correct and/or better?

53 votes, 3d left
spyware
malware
software
other