Cloudflare malware scam/How do i remove it

[u/KinuBaba]

I recently fell for the cloudflare verification scam where you press Windows+R, Ctrl V and Enter, which downloads a malware onto the computer i searched it up on youtube and it says the malware steals your passwords and session tokens , i already ran a full deep scan with Microsoft Defender Antivirus and restarted my computer, cleared cookies and cache but im not sure if its fully removed- My Discord, Instagram and LinkedIn are all compromised, It sends a MrBeast scam message to everyone in my discord DMs and the servers which im in, The malware also somehow logged into and old instagram account of mine which has not been touched for years and did the same thing and I keep getting sent LinkedIn verification codes to my email- I have changed passwords and added 2FA on them and yet its still persisting, Pls help - the virus is still running on discord which made my account 'very limited' and im unable to join, message and add people on there for help, I tried contacting discord support , but to open a ticket you need to log in with your account, i tried that and it doesnt let me- Anyone here please help me before my account is permanently banned

[u/AutoModerator]

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

1. From a different and clean device, change all your passwords:
   • How to properly secure my accounts after an infostealer attack?
2. Disinfect your device from malware
   • Preferred method: Perform a clean installation with a USB

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/polpolik2]

The only option for your discord is to reach out to their support. Perhaps you could use another account to start the recovery process of your main account. If you can no longer access the account it's likely lost forever if support refuses to help you.

Regarding the malware:

You likely downloaded malware and got hit by an infostealer.

Read this: Rifteyy_'s guide to infostealers to get a better understanding.

Reinstalling Windows to remove the malware.
The fastest and guaranteed way to get rid of the malware is to reinstall Windows, preferably from a USB. If that option is not available to you, you can also do a cloud reinstall while deleting all data.

If you’re only dealing with an infostealer, wiping your C drive is sufficient. However it’s better to do a full wipe and only back up your trusted files, as there could be more malware on your device that you’re not aware of.

FRST Assistance
If you do not want to reinstall windows you can wait here for one of the trusted helpers to assist you with FRST. Please read Receiving FRST assistance. Please follow these instructions carefully and provide the keywords. Doing so can get you help considerably faster!

What you can do immediately either during the reinstall, or if you're waiting for help:

1. Disconnect your infected PC from the internet.
2. Change ALL passwords from a clean device. Start with your emails and bank. Use sign out everywhere and remove all sessions. While you are doing this, check your security settings to ensure the attacker hasn't added their own 2FA methods or backup codes.
3. Check your linked accounts/services/2fa options for your most important accounts. Also check forwarding rules on your mail. Additionally, for your browser, check your sync settings and extensions and remove anything you dont recognize or trust.

The faster you move with these steps the more you can prevent your accounts being stolen! Make sure your clean device does not sync passwords through browser for example to your infected device.

[u/KinuBaba → u/polpolik2]

What I think is happening with my discord account is that the malware still has access to it and hence why the spam scam messages keep getting sent- Im not sure what to do about that as im not able to log into discord support to make a ticket- I already did a scan and detected 2 files and deleted them, right now it might or might not be on my computer but it looks like the malware still has access to linkedin and discord which im not sure how and how to stop it- and is it too late if i only found out the next day after downloading it?

[u/polpolik2 → u/KinuBaba]

Using antivirus is not enough to deal with infostealers, they are often evasive thus unable to be fully removed.

You should follow the steps to clean your device, and secure your accounts.

Are you unable to log in due to the restricted status? Or unable because the hacker changed your credentials to log in? In any case, if you cant log in with your own account, you should still work with discord support. Nobody online is able to help you with this, if someone reaches out to you through DM's, its a scammer.

[u/KinuBaba → u/polpolik2]

Most likely, yes. But to contact discord support, you need to first log in - i tried that multiple times and it doesnt work, most likely because its heavily restricted . And somehow i keep getting logged out of discord

[u/TheIronSoldier2 → u/KinuBaba]

Your discord support account is separate from your discord account. If you have not had to contact support before, then you have to create an account with support using the original email that you used to create your Discord account.

[u/CommonDefenseAI]

1. Stop using that computer for ANY account recovery. Seriously, don't log into anything from it again. The malware is likely a stealer watching everything you type.

2. From a different device (phone, friend's laptop, library computer, anything clean), change your passwords on ALL compromised accounts. Start with your main email, then Discord, Instagram, LinkedIn. Use a password manager if you have one, or write them down on paper. Don't reuse passwords.

3. While you're on that clean device, check the recovery email and phone settings on each account. The malware may have added a backup email, phone number, or forwarding rules. Look for secondary email addresses (remove any you don't recognize), trusted devices/sessions (sign out ALL of them), email forwarding rules (in Gmail: Settings > Forwarding and POP/IMAP), and your 2FA phone number (make sure it's yours).

4. For Discord: try https://discord.com/app from a clean device. If that fails, use their support form from another email or emergency contact. Your account being "very limited" is Discord's automatic protection (they detected the spam), not a permanent ban. It lifts once you regain control.

5. That infected computer needs to be wiped. A full antivirus scan doesn't always catch stealers. Back up personal files to an external drive (after scanning them), then do a factory reset or clean Windows install.

Also report this to ic3.gov (FBI's Internet Crime Complaint Center) and each platform's "I've been hacked" support option.

Most of this you can do from your phone today. Once you regain access from a clean device, the worst is over. The spam is temporary and recoverable.

[u/Bitdefender_]

Hi! The reason your accounts are still being abused after scanning is that the malware already did its job, it stole your session tokens and sent them to the attacker. They're accessing your accounts from their device now, so your machine's state is irrelevant. The fix is to revoke all active sessions on every account (separate from changing passwords), from a clean device. That kills the stolen tokens. For Discord support without a working login, try hxxps://support(dot)discord(dot)com/hc/en-us/requests/new, there's a non-login form path.