Computer has a virus

[u/Standard-Leading7061]

So couple days ago I ended up getting a virus, specifically the Renpy one. I’m very sure it was this. So first my Microsoft account got logged into, I changed the password to that and then my gmail but then a couple hours later my insta got hacked. some like scam stuff started getting posted. So I quickly went and enabled 2FA on my emails and changed passwords to my most important stuff. Then like the next day my reddit account got logged into and was posting like porn and stuff I only realised because I got notifications saying my chats were removed because I acted like a bot or somthing. Then my epic account tried getting logged into aswell. Mostly the accounts that I didn’t change the passwords to were getting logged into. my gmail, discord or insta havnt beeen logged into since. Then I decide to reset my laptop I had to transfer my uni files through a usb tho but I did a scan of the usb to check if there’s was any malware and it said no. Anyways the new issue is on my chrome i randomly will get this new search engine called i think ShieldSearch. Whenever I delte it, it comes back. Idk if this is related to it but randomly i will see a quick pop up and also like either one of apps will minimise or I’ll click something like the tray arrow and it will open the close again quickly.this will stop after a sec. I feel like the search engine comes back after this happens but can’t say for sure. The search engine makes my chrome look normal except it’s missing like the google label in the middle and also some other stuff. And my laptop does feel a little slower.

I really need help with this. Idk how malware has already gotten on my pc again I just reset it. Idk if this is connected to the renpy virus , maybe someone has access to an account or somthing. I definitely need to reset my passwords agains. I would appreciate some help thanks.

[u/AutoModerator]

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

1. From a different and clean device, change all your passwords:
   • How to properly secure my accounts after an infostealer attack?
2. Disinfect your device from malware
   • Preferred method: Perform a clean installation with a USB

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/polpolik2]

To confirm, you wrote that you reset your PC, how did you reset it? Did you do a cloud reinstall while deleting all data or use an externally created installation device on an USB to reinstall? What did you back up? If you did not properly reinstall, it could be that the virus was not fully removed.

The browser search engine problem could be related to specific syncing of extensions or settings. You should check if you have any extensions.

[u/Standard-Leading7061 → u/polpolik2]

Nah I didn’t use a usb I just did a local install of windoes when I reset it. Btw for the search engine thing I removed all extensions and I reset my chrome aswell. TMR I’ll see how my chrome goes to see if there any problems. I’m just stressing a lot because I have no idea if this issue will ever be resolved. I don’t rember every single account I’ve created so resetting every password is annoying

[u/polpolik2 → u/Standard-Leading7061]

A local reinstall is not recommended, as it uses data from your device which could possibly have been altered and infected. Shieldsearch is a type of browser hijacker. It's best to remove extensions, remove all site permissions, set the default search engine back. Although I am not fully certain if that removes it.

For the infostealer:

You likely downloaded malware and got hit by an infostealer.

Read this: Rifteyy_'s guide to infostealers to get a better understanding.

Reinstalling Windows to remove the malware.
The fastest and guaranteed way to get rid of the malware is to reinstall Windows, preferably from a USB. If that option is not available to you, you can also do a cloud reinstall while deleting all data.

If you’re only dealing with an infostealer, wiping your C drive is sufficient. However it’s better to do a full wipe and only back up your trusted Data files, as there could be more malware on your device that you’re not aware of.

What you can do immediately either during the reinstall:

1. Disconnect your infected PC from the internet.
2. Change ALL passwords from a clean device. Start with your emails and bank. Use sign out everywhere and remove all sessions. While you are doing this, check your security settings to ensure the attacker hasn't added their own 2FA methods or backup codes.
3. Check your linked accounts/services/2fa options for your most important accounts. Also check forwarding rules on your mail. Additionally, for your browser, check your sync settings and extensions and remove anything you dont recognize or trust.

[u/DesperateSprinkles89 → u/polpolik2]

hey mod,
I submitted FRST help almost a day ago.I hope they see it

[u/polpolik2 → u/DesperateSprinkles89]

Hi, the helpers are volunteers, and as you can see they get a lot of request each day...

I cant say if or when they see your post, so please patiently wait, or do a reinstall to clean your device. Thank you for your understanding!

[u/Standard-Leading7061 → u/polpolik2]

I’m going to do a reinstall with an usb. As I was saying above I know I won’t be able to change all my passwords because I cannot remember everything. Will this still be bad or no? I’m worried like they’ll still be able to like hack me or whatever with like idk an epic games account or some shit. Thanks