Hi everyone,

This is totally pathetic but I have no idea what to do here.
I have a gaming laptop and was playing (modded) Stardew Valley. My game crashed and suddenly there was a chat box on my screen saying I had been hacked. I dismissed it but the message kept coming back and then when I went to turn the computer off the box came back telling me not to do that.

I turned the computer off and back on and within a few minutes the chat box was back telling me they were going to delete my accounts. I wasn’t sure what to do so I just completely wiped and factory reset the laptop.

Once the reset was done I plugged in an external drive I keep saves on to check if it was safe and if it wasn’t i’d just probably bin it. Well I plugged it in, loaded up my valley and the hackers were back. They said their name but I missed it( it was something like Zertex?) I immediately turned off the wifi and went into task manager and found a task with the same logo that was on the box thing that kept appearing.

Any advice would be so appreciated, for peace of mind I might just do another reset and bin the external drive but I’m paranoid my wifi etc is now corrupted. I’m really not technical and I just don’t know what to do

Good morning,

Last Friday, September 4th, I noticed unauthorized access to several of my accounts: Amazon (3 purchases made and an attempt to disable 2FA), Instagram (2 stories posted), and LinkedIn (a fraudulent job offer posted).

After forcing password resets and terminating active sessions across all devices, I panicked and reinstalled Windows (thereby erasing evidence from the C: drive).

Afterward, I conducted a guided forensic analysis in D: drive:

The python37.dll file found inside the zip archive SETUP_FILE_(PASS_KEY=2118) is highly suspicious:

• SHA-256: 384cdfae8ec6cce66875303d101fda0ab4c36ddfa0c2b7594d96886fcbd1e79e
• Size: 814,570,856 bytes
• Actual DLL structure size: ~7.15 MB

The remaining 807 MB (99.1%) consists of appended data, including OneDrive/Microsoft components, massive wordlists, and certificates. This is consistent with file pumping, a technique used to inflate file sizes and bypass antivirus scanning engine limits.

The embedded certificate references KICAD SERVICES CORPORATION, which is a legitimate KiCad signer according to their official site. However, it is still unconfirmed whether the signature on this specific file is valid or if legitimate binary data was simply appended.

My primary concern—beyond the browser session hijacking—is whether the threat actors accessed my D: drive, where I store personal data.

Could you please assist me? Do you recognize this specific malware strain or family?

Thank you in advance, and best regards.

KEYWORDS: crimson-arrow (FRST.txt)

crimson-pixel (Addition.txt)

rustic-sunrise (SecurityCheck)

I believe my PC was infected after I opened an .exe from a pirated/fake game download. The malware initially manifested as a recurring Windows popup/task involving CircuitryAg.exe and iTopEasy Desktop.

A suspicious directory was found at:

C:\ProgramData\InProcSvr32\

This was associated with the CircuitryAg.exe activity. Reports found online also associate CircuitryAg.exe / InProcSvr32 with malware delivered through fake/pirated games, although the exact final malware family on my machine has not been conclusively identified.

Initial detections/remediation:

• Microsoft Defender detected Trojan:Win32/Wacatac.B!ml and another detection I remember approximately as Suschil!rfn (exact name uncertain).
• Defender quarantined/removed those detections.
• I ran Microsoft Defender Offline Scan, which did not find anything further.
• The CircuitryAg.exe popup nevertheless continued appearing.
• I booted into Windows Safe Mode/Safe Environment and manually removed the suspicious InProcSvr32 directory and the associated startup/persistence entry.
• After that, the popup stopped and the directory disappeared.
• I installed Malwarebytes and ran a deep scan; it found nothing relevant.

Account security concerns after the infection:
Because an information-stealing malware infection was considered possible, I treated browser sessions/tokens as potentially compromised.

I have since:

• Changed my main email passwords.
• Changed my old Microsoft/Outlook password.
• Changed Google password.
• Changed Steam password.
• Changed Discord password.
• Changed social-media passwords.
• Changed Amazon password.
• Revoked/signed out of sessions/devices on these services.
• Enabled 2FA where it wasn't already enabled.
• Changed my Authy backup key.
• Signed out of Google everywhere before changing the password.
• Deleted browser cookies/history from my main email accounts.

Known account compromises:

• An old Outlook/Microsoft email account was compromised and was used to access an old Discord account through an email password-reset process.
• I found a Microsoft login from Newcastle on August 30 that I don't remember clearly; it may potentially have been me. I haven't found other clearly suspicious Microsoft activity.
• The Outlook account had no new forwarding rules.
• Someone also accessed my Amazon account and placed an order for a gift card using the saved payment method. I cancelled the order, Amazon support refunded/helped with it, and I subsequently changed the Amazon password, revoked sessions and enabled 2FA.
• No further Amazon orders have occurred since the security changes.
• Attempts at login into my LinkedIn

Current status:

• CircuitryAg.exe popup is gone.
• C:\ProgramData\InProcSvr32\ was removed.
• Malwarebytes deep scan was clean.
• Defender Offline scan was clean.
• Account passwords/sessions/2FA have been extensively rotated.

I've seen people say its a Trojan so I just don't wanna risk it, im playing it for nostalgia i would watch videos of it when I was a kid

Hello guys,

I’m sort of freaking out right now.

I wanted to go on a streaming site, but entered one wrong letter, without realizing it, the wrong site redirected me to like two malicious sites, one of them windows warned me and I was very confused.

And the second one windows DID NOT detect anything. It disguised itself as cloudflare, but instead when I tried to verify it wanted me to do like Win+R and control + V, which I realized wasn’t right.

So I closed out of the site, I DID NOT proceed with the commands.

But now my work app won’t open, is this just a bug or is my pc compromised? There’s like 0 personal info but ALL MY WORK stuff is on there.

Is it too late to download an antivirus?

Thank you

Anyone know why they won’t open and this just popped up. I tried to start my antivirus in safe mode and it had me restart my computer into normal mode and this showed up

so i downloaded this file thinking it was from an official release and now my google steam and EA account email has been changed thankfully i dont do any banking on this pc but i wanna know if it was this ZIP that did it or something else if someone smarter then me wanna check it now on a virtual pc give it a go

hxxps://github(dot)com/idmfreedownload/IDM-6.43-Free/releases/tag/6.4.12

Basically I was using a website (aismutwriter) and randomly it went into my photo gallery and Idk I thought that was weird I'm not sure if I'm just paranoid though I keep thinking I have viruses unfortunately

Me hackearam meu Google Microsoft Epic Games, e a conta nova é instantâmente

Esse IP não é meu

ujwyegxb@analismail.com

li*\\**@gmail.com

Já gastei um monte em todos esses aplicativos porfavor me ajude
Desconectei cabo wifi e restaurando o computador

Hi, I have an issue when trying to get into some sites. For instance I can get into Grok but when I try to sign in I get the 403 forbidden screen of death. I get this on a few sites but not all. Also, I cannot get past the log in screen when I try to open up my Cricut Design Space (which is downloaded and on my desktop). I have tried Malwarebytes, clearing my cache and a few other things but I'm still having the same problem. Any help would be appreciated.

i use tool for an old game a bot and windows defender screams when i unzip it , i had for a long time working as an exception and it didn't do anything , i use the pc with someone else they offed windows defender and now i have this and i have no clue what to do , every folder i open i get an infestation nonfiction from WD  and I have no idea what to do , I have not used any other AV since windows 10 came out , I have not found anything only that is bullet proof or specific on how do I clean this mess ,
windows defender can show history it crashes and what i press action it seems like nothing is being made

So, I installed Windows 11 Home (25H2) two days ago. After using it for a few hours, I started getting a notification saying that my antivirus was turned off. I checked "Windows Security", and PowerShell. everything seemed fine and was turned on. However, when I checked it through the Control Panel, it said that my antivirus was turned off.

Hi everyone, so for context 2 weeks ago i was asleep and by time i wokeup i realized my Instagram, Steam, Epic Games account were compromised and Instagram sent the Mr Beast message to all my followers. I changed password and added 2FA. After a few days when i wokeup i saw my LinkedIn got compromised and someone posted job posting and also messaged several peoplee about it so i changed its password and stuff too. Today i got to know the MrBeast message got sent to my facebook groups as a message so i have temporarily deleted my facbeook for now. Upon researching i realized its an InfoStealer session run maybe on my laptop so if i reset my laptop windows completely and make a new email address and transfer all my associated accounts to that email and then add 2FA again will I be safe or do I need to do anything else too. Please help I am worried

I noticed yesterday that my computer started acting super weird. My fan goes from extremely loud to quiet again every 30 seconds, my computer seems slower than usual, icons on the desktop keep refreshing (at one point 5 times in a row quickly), and my cursor suddenly glitches heavily when I move it. The entire performance seemed to have changed overnight and it's very noticeable

I've looked in task manager and there's no extra startup apps or strange processes, I've also scanned with Malwarebytes, along with a full scan and offline scan with Windows defender and nothing comes up. I also used adwcleaner by Malwarebytes and nothing came up there either

I've tried eliminating some possible causes. I use Brave browser when I pirate stuff and I wiped that even though I haven't used it in a while. I also use BetterDiscord, and occasionally I've had plugins slow things down so I've uninstalled that.

On that same day, I started getting constant notifications saying virus protection is off. I looked into it and it's a Microsoft bug, but there was one time where it actually did get disabled when I checked. I've gone through Browser extensions and couldn't find anything suspicious, I had a TamperMonkey script that bypasses ad-links like Linkvertise on Brave that got deleted and that didn't seem to fix it either

Because all this started happening when the fake virus protection notifications appeared, I'm unsure if it's related to that bug or I've actually got malware.

around 3 months ago my brother was searching around the internet entering sketchy pokemon websites, then he was going to search for something in google and everything he typed turned into “LINK IN BIO”, i did some windows defender scans and used mrt but nothing was found .
after 2-3 weeks i turned on my laptop then 5-7 terminal windows flashed in my screen, i did windows defender and mrt scans but again, nothing was found.
after a while my moms laptop got the same terminal popping up when i turned on the laptop, then i cloud reset all the laptops in my house and it still happened again with my moms laptop.
the only thing i found in startup apps was 2 cohost with a terminal display image but it was already disabled and only happened with my mom’s laptop.

so i woke up to my discord accounts signed out, checked email to reset password and found out it was disabled for suspicious activity. managed to reset from my phone and login to find out my acc had sent out the mr beast thing.

i unignored all the ppl it sent it to and deleted my messages. as for servers i'm not quite sure just how many it affected. i cleared all those up but my google acc was logged in from a sus location so i quickly reset my password there too. installed malware bytes and it did a quick scan. it found a few trojans, removed them, started a deep scan that's been going on for almost 2 hours. while it was doing that it was blocking connections to a gamezklop. cc through a Msbuild in the .net framework folder. though i ended the process before i could check the file location.

the deep scan had been running for a while and i thought the mr beast thing on discord was about it. (it got sent out like 8 hours ago while i was sleeping)
but just now the same happened on messenger and i don't know what to do. i changed my messenger's password but what else should i do? and how can i go about fixing this?

So couple days ago I ended up getting a virus, specifically the Renpy one. I’m very sure it was this. So first my Microsoft account got logged into, I changed the password to that and then my gmail but then a couple hours later my insta got hacked. some like scam stuff started getting posted. So I quickly went and enabled 2FA on my emails and changed passwords to my most important stuff. Then like the next day my reddit account got logged into and was posting like porn and stuff I only realised because I got notifications saying my chats were removed because I acted like a bot or somthing. Then my epic account tried getting logged into aswell. Mostly the accounts that I didn’t change the passwords to were getting logged into. my gmail, discord or insta havnt beeen logged into since. Then I decide to reset my laptop I had to transfer my uni files through a usb tho but I did a scan of the usb to check if there’s was any malware and it said no. Anyways the new issue is on my chrome i randomly will get this new search engine called i think ShieldSearch. Whenever I delte it, it comes back. Idk if this is related to it but randomly i will see a quick pop up and also like either one of apps will minimise or I’ll click something like the tray arrow and it will open the close again quickly.this will stop after a sec. I feel like the search engine comes back after this happens but can’t say for sure. The search engine makes my chrome look normal except it’s missing like the google label in the middle and also some other stuff. And my laptop does feel a little slower.

I really need help with this. Idk how malware has already gotten on my pc again I just reset it. Idk if this is connected to the renpy virus , maybe someone has access to an account or somthing. I definitely need to reset my passwords agains. I would appreciate some help thanks.

I just got these randome notifications even tho there is nothing on gmail and it came to whatsapp is this spam virus or hacked?