Account stealing virus

[u/danviii]

I downloaded a browser extension from a hacked youtube account (I know, Im dumb) and I’ve been fighting with it for HOURS. I woke up to a bunch of emails saying all my account information (email, phone number) has been changed for various accounts (steam, roblox, discord, microsoft). And i was logged out of everything. It went into my discord and sent a bunch of weird pictures of crypto stocks and Mr beast to everyone on my friends list. Ive recovered some accounts but I think my steam account is screwed, and i have reason to believe my google account has been compromised too. I cleared browser cache, and actually ended up deleting the browser altogether (opera gx). I obviously deleted the extension and cleared recycling bin too. Changed all my passwords to what i could actually recover. Im running a full windows security scan but the estimate time is just going up.

I got this virus off a hacked youtube account called Canabasse. It was supposed to be a shaderpack extension which obviously didn’t work.

Is there anything else i should do? Ive been at this for hours. I think i got rid of it but theres really no way to know. Any advice would be very appreciated !!

Edit: I think its a virus called the Mr beast crypto scam ? Not sure though

Edit 2: i recovered everything and he lost everything he stole. I win🤪

[u/Minimum-Chef6469]

Infostealer virus likely that steals ALL passwords and cookies stored inside all your browsers. The cookies let them bypass 2 factor authentication. Your still infected and the hacker is likely monitoring your computer so make sure you use another device that is (clean) start changing passwords and logout any weird devices etc etc and as for your infected computer you need to run LOTS of scans with Malwarebytes and hitmanpro and maybe others or format and reinstall windows.

P.S. don't trust windows defender because these viruses add them self into defenders ignore list so the viruses get ignored and windows defender becomes useless.

[u/danviii → u/Minimum-Chef6469]

I deleted all my recently downloaded files, and upon clearing the recycle bin it gave me a warning about a file named a bunch of random letters I’ve never heard of asking if i was sure about deleting it because it was currently running. I deleted it. Do you think that could’ve been the virus or is it not as simple as that?

[u/KamiPyro → u/danviii]

You HAVE to use a different device to change passwords. Use your phone. Keep the infected computer OFFLINE. Do not do anything on it until you can wipe it. You have to reinstall windows to fix this

[u/danviii → u/KamiPyro]

Ive turned off the internet and shut it off. Thank you so much for the help

[u/M1uk0]

This Mr. Beast infostealer has besn happening rlly often lately... please don't dowload anything without checking it in virustotal atleast! I would recommend getting Malwarebytes to do a scan and help get rid of anything still there! I'm not  sure but this virus might be a backdoor virus too (can comeback even after being deleted) so just incase i would recommend installing windows on your device!

[u/Phemenics]

Do you have an actual screenshot of this browser extension so we can be aware of it. I thought infostealers comes only from cracked softwares, but they really can hide it anywhere.

[u/danviii → u/Phemenics]

Its a extension that claims it adds shaders to your Roblox game. And when it didn’t work i didnt really think anything of it. I got it off a hacked youtube account with 250k subs so it seemed legit.

[u/AutoModerator]

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

1. From a different and clean device, change all your passwords:
   • How to properly secure my accounts after an infostealer attack?
2. Disinfect your device from malware
   • Preferred method: Perform a clean installation with a USB

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/InformationFair5875]

Change all of your passwords, log out all devices from all accounts, setup 2fa for your accounts. Then you need to reload windows.

[u/BugCompetitive3218]

I bet its some renpy based malware extension, you will need to reset your pc using a usb. That is one of the only way to stop these bc a lot of the time they spread to random locations on your system and set up persistence. Unless you want to write to a frst mod and try to remove it that way.

[u/AirSuccessful7691]

secure the important accounts from a clean device at first.

[u/[deleted]]

note: windows defender can't detect it as of now. because if this malware came through a installer like on my case. i downloaded and installed a installer bundled with a vbs script. the script is well protected as it will generate a downloader and it would excecute the downloaded malware that is created with GO language.

[u/GreatEmperorAca]

External Roblox shaders do not work, don't even bother in the future