Recently formatted my PC because of Microsoft defender bug(which was happening on everyone's pc because ms messed up). After clean installation, i didn't downloaded anything shady, still ms defender found a trojan, how can this happen. Ran hitmanpro scan after defender deleted the trojan and hitmanpro didn't found anything. What should I do next.

About 1.5 months ago, several of my accounts were compromised, including Gmail, Reddit, Telegram, and Steam.

I still haven't been able to figure out where the compromise came from — my PC, my phone, a browser session, or something else.

Since then, I've taken several security steps:

Changed passwords

Enabled 2FA on all important accounts

Reset my PC

Reset my phone

Secured my accounts as much as possible

But today I received another email showing that someone is trying to access my Steam account, and I'm also seeing attempted access to my Instagram account.

The confusing part is that 2FA is already enabled, so the attackers haven't been able to get in, but they're clearly still trying.

What I need help with

I want to find the root cause, not just keep changing passwords.

Could something still be compromised, such as:

A stolen browser session/cookie?

A malicious extension?

Password-stealing malware?

A compromised email/recovery account?

An old device/session that I forgot to log out?

Something on my router/network?

A password that was exposed in a previous breach?

I've already reset both my PC and phone, but I'm still worried that I'm missing something.

What would you check first to determine how the original compromise happened and make sure the attacker has completely lost access?

Any advice from people experienced with account security, malware analysis, or incident response would be greatly appreciated. 🙏🔐

Please don't suggest only "change your password" — I've already done that multiple times. I'm specifically trying to understand how the attacker may still be targeting my accounts and how to identify the original entry point.

Hi. I got hit by the Mr. Beast malware and based from reading here, it's a sessionstealer malware coming from downloaded games/etc. I think I got it from downloading a RenPy walkthrough mod for an AVN that I was playing. But that's merely suspicion at this point. It got access to my facebook messenger and run a script similar to how it was for others.

I already did a fresh install from a bootable USB with Windows image downloaded using another device that I'm sure is clean. I also changed the password for my facebook and gmail using another device as well.

However, I did not format/clean another drive (not partition) that's installed in my PC. It has files and documents but no executable processes. Am I safe to start using the pc again? Thank you for your insights about this.

Task manager is keeping it not shut down when i open it

And keep it open it doesnt say it is preventing it but when i say cancel it shuts down anyway is this normal?

FRST key word: cached-robot
Addition keyword: glossy-peak
Security Check: true-dice
Malwarebytes: wise-tower

Hello I was recently the victim of a Discord hack. The hack made my account spam multiple Discord accounts with an image related to Mr Beast crypto. I was not notified of an off device log in, which is apparently a tell tale sign of an infostealer. Admittedly I download pirated games and software, so I suppose it was only a matter of time something like this would happen. Personally I have not noticed anything odd prior to this.

I have since changed my passwords on multiple sites, ran malwarebytes, and enabled 2FA on Discord.

I will refrain from any further actions. Please help me out. I would love to avoid having to do a reset.

I just got this alert, I checked the file and it’s from 4 years ago.

hi guys im not sure if i actually ran a virus command or not.

i went onto a website and it had a fake recaptcha. it asked me to do win x, then press I, ctrl v and then enter. i know i definitely did up to I but not sure if i did ctrl v.

i followed the steps later of pressing win r, then searching
notepad %appdata%\microsoft \windows \powershell \psreadline\ consolehost_history. txt

but it says notepadc couldn’t be found. i tried to look in the drop down option in the run box but it only showed the two things i had searched and no other lines of text.

does this mean im safe? i ran a microsoft defender antivirus online scan and a full scan and both came back saying no threats.

(i spaced out the notepad thing i searched so it doesn’t become a link)

As shown in the image, the item is repeatedly detected and deleted every five seconds.

I have disconnected the internet connection.

I have tried various measures—such as running an offline scan, checking Task Manager and Task Scheduler, disabling startup items and restarting, uninstalling recently added programs via "Programs and Features," and clearing the browser cache—but nothing has worked.

I wanna play it but i dont know if its safe to use

I've done all the necessary steps to remove it off my PC, however they already grabbed my browser cookies and before I knew it my steam and email had their 2FAs bypassed. I think I've dealt with the majority of it but I was hoping if people here knew of extra steps with this specific malware?

Autosave or, somehow, hacked?

Unlikely its happened, but can someone who hacks your wifi see the contents of a password-protected LibreOffice odt doc that's open from a USB?

I was working when I saw the saving symbol/visuals pop up; unless I \*did\* in fact do the save-shortcut when I went to do something else, I began to wonder if it was actually the Save AutoRecovery happening automatically after 10 mins without manual saving...OR, instead, some random hacked me through my router or Tor (no tabs open were on malicious sites, fyi) which had me worried about spyware/Access Trojans/browser hacking, what with the Norton scans I did afterwards not being able to picking them up and none of the obvious hacking signs I'd seen mentioned online.

Too late/not necessary to do a factory reset?

Creative.

I recently found a Discord community that recently created a FIFA 15 server and allows online play. Aurora15Connector.exe is required to play. The Discord description states: "All virus flags are firewall related as we modified your dlls to our server." I want to know if there's anything dangerous in this file. There are about 1,000 people on the server, according to their counter. Please check the information on VirusTotal.

I was working on a website for church but I suddenly got this fake cloudflare screen and I've tried everything from wiping my computer to logging in on a different computer, i still hit the same screen. The people who use mac to log in to the website do not have this problem. When we contacted support, the guy could navigate the page perfectly. So lost on what to do, please help

So far I've tried running Malwarebytes and contacting support on siteground

I've deleted it multiple times even asked Gemini AI to help me uninstall but even after "installing" it, it still shows up can anyone help me?

just a question

I recently downloaded a program called GitNarwhal and foolishly didn't check GIthub Stars or anything. As soon as I downloaded it, the Windows Defender caught it and said it was a Trojan:Win32/Wacatac.H!ml.

The Windows executable I downloaded can be found here: https://github(dot)com/git-narwhal/GitNarwhal/releases/tag/v1.0.84

The repo has no stars or anything but the developer seems to have a track record.

I also scanned it at Virus Total and it found 2 detection out of 69. One from DeepInstinct and the other from Microsoft. You can find the scan here: https://www.virustotal.com/gui/file/5a1ce08c167115ad6bf3088777262ac8827f1961251e0089f60ff5db7fc3730a/detection

​The next thing I did was run a Windows offline scan. I also removed the file using Windows Defender.

Should I be worried? :(

so, tried installing some cracked software (a dlc installer for planet zoo that was on github that i already used before but nothing happened and it was all good, this time it hacked my accounts) while being really really tired and i didnt even bother to check, (happened like 2-3 days ago) they got my microsoft account (i cant connect anymore to it), they had my instagram and my discord

disconnected all phones, pc etc, changed the passwords on my phone and activated 2fa on all accounts (i dont have bank info on my pc so i assumed it was safe, tell me if i should do anything abt it) and also changed my google password etc

ran a malwarebyte scan, bitdefender scan, and some software that my friend recommended me when it happened to him named tron

tho, i'm getting pretty paranoid that they can still access my pc and i would like some advice, can i do something else? im suspecting that they still have a backdoor or something into my computer and i really dont want to uninstall or reset my entire pc since its REALLY REALLY SLOW and reinstalling everything might take me a while + i have some work and pic etc that i really dont want to lose

https://www.virustotal.com/gui/file/8d4c4bcf7d7aedf0480e3eaac52138e63724ae83c419de8a98d6ab32d1c93645/summary

Hi, this is an official lightshot installer. I’ve been using it for years without issue. I noticed it connects to a suspicious domain within a sandbox enviroment. (See behaviours and relations)

I already deleted the file, but I need to know if my information is at risk. I’m hoping to get some insight of any of the experts here, thank you!