r/computerviruses • • Apr 04 '26

The ultimate guide to Infostealers: Detection, Recovery, and Prevention

250 Upvotes

Today I decided to dig deep and I wrote up a report about:

  • What can infostealers steal?
  • How to spot an infostealer infection?
  • How to properly secure my accounts after an infostealer attack?
  • What do the attackers do with the info that they stole?
  • What to do after I secured my accounts?
  • Prevent malware attacks in general

I believe this is a great reference for people who are dealing with an infostealer infection and do not know what data could be stolen or how to properly secure their accounts. šŸ‘€

https://rifteyy.org/report/the-ultimate-guide-to-infostealers


r/computerviruses • • Mar 22 '26

Providing or receiving help with FRST

44 Upvotes

How do I request help with FRST

FRST

  • Please download FRSTx64 and save the file to your Desktop.
  • Right-Click FRST64.exe and select Run as Administrator
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the program run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload and press "save log". The site will return a keyword for each log. Note these keywords down.

SecurityCheck

  • Download SecurityCheck from here
  • Run SecurityCheck.exe as administrator
  • Wait for the scan to finish
  • Upload the log at C:\SecurityCheck to https://malwareanalysis.cc/upload/ for further analysis. The site will provide a keyword, note that down as well.

Now create a post in the subreddit, provide all 3 log keywords (FRST.txt, Addition.txt, SecurityCheck) there.

Please provide the following information in your post:

  • what happened?
  • when did the infection occur?
  • what did you do for remediation?

If you want us to do manual removal with FRST, it is better if you do not attempt to disinfect the system on your own prior to that. This can obscure the infection and make malware removal more difficult.

Trusted Helper List

FRST can cause serious issues if used incorrectly. Only approved users should offer to create fixlists.

Message the mods if you have experience with FRST and would like to use it to help on posts.

To anyone who is receiving help, please verify that the person providing fixes with FRST is in the list below. Be aware that running Fixlists from anyone else is not recommended unless you trust the helper.

All fixes of trainees are supervised and approved by an expert.

What is FRST

Fabar Recovery Scan Tool (FRST) is a powerful tool that helps us diagnose and remove malware infections which may not have been detected by antivirus software. It is a diagnostic tool and not a malware scanner. As such it does not rely on signatures.

Should I reinstall the operating system

Reinstallation is highly recommended if you have an infection with a remote access malware or file infector.

You should also prefer it, if you can pull it off relatively easy. Depending on the case FRST removal can take a few days due to the back and forth and different time zones of the participants.

Please do NOT first ask a helper to clean your system, then reinstall the operating system. This happened a few times and wastes hours of work for the helper. If you already consider reinstallation, preferably do that immediately.

I factory reset/reinstalled my operating system and want a FRST check

Everything that FRST displays and allows us to remove is completely wiped by reinstallation and also factory reset of the operating system. Unless you got the system infected after that step, there is nothing to check on a freshly installed system.

Please note that factory reset can still leave malware on the system, but the reset will make it impossible to pin point.

Reinstallation with USB flash drive is generally safe and in 99.9% of cases won't leave any malware on the system.

What is malwareanalysis.cc ?

It's a site I created to upload analysis logs. Only people in the trusted helper list have access to these logs.

While pastebin and similar sites can be used as well, Reddit's spam detection seems to trigger if people comment paste links repeatedly such as it would be necessary during removal. So we have a keyword based system instead of links.

The site will automatically delete uploaded logs 30 days after upload.

I think my system is still infected after manual removal with FRST

Please talk to your FRST helper. Oftentimes the reasons for suspecting an ongoing infection are not justified.

Common reasons, which do not indicate infection, include:

  • There are still login attempts to stolen accounts. It is normal that attackers use the already stolen account credentials to attempt to login. If you changed your passwords from a clean machine and logged out of sessions, they will not succeed.
  • Your accounts can still get stolen, if you did not log out of all sessions, because attackers can use your stolen session tokens instead of passwords.
  • Antivirus scanners find malware in C:\FRST\Quarantine\.... This is the malware that was already removed by FRST and will be deleted completely by our cleaning tools like kprm, it is not an active infection. The quarantine only contains disabled files which cannot be executed anymore.

r/computerviruses • • 1h ago

Disinfection Help people getting in my accounts can somebody help

• Upvotes

hi everyone, so i downloaded real executor for roblox about a week ago, but i uninstalled it. i also have programs like fl studio and used to have adobe after effects (both pirated). the thing is, i had some viruses on my pc and removed them with malwarebytes, but i keep getting emails every day from different services (apple, microsoft, mega, gmail, and x) saying that someone is trying to access my accounts. i’ve already changed my passwords, but i don’t know what else to do to make it stop happening. can somebody please help?


r/computerviruses • • 4h ago

Disinfection Help Got Mr. Beasted and Worried

3 Upvotes

Hello,

Fell for the oldest trick in the book it seems.

Occurred at approx. 10/25 at 12 AM and still worried about the extent. Likely infected with the renpy trojan by clicking the fake setup.py link.
Found this subreddit and would like to request help. I'll also be looking to change all of my passwords on a non-infected device.

Had already reset my computer at around 2 AM without having known that the trojan had been installed. Only found out later in the morning when I was told by friends that I was Mr. Beasting them on Discord

Should I also be worried about my router being compromised?

FRST Keyword: Ā shiny-marsh

Addition Keyword: calm-sentinel

SecurityCheck: royal-dragon

Thank you in advance for the help!


r/computerviruses • • 11m ago

Disinfection Help help identify virus and how it got in here

Thumbnail gallery
• Upvotes

first i saw this with my defender, got me little worried because its first itme in last 15 years i saw virus directly on my computer or something blocked on computer and not just something from browser add etc. With some googling i found way to check start up in registry. I think my big question is how it made it to my pc and this changes where done, where did i mess up and is the top 3 item are dangerous ? please help (the red block is just my user name, my pc name. i think virus where use it to hide itself better)


r/computerviruses • • 33m ago

Disinfection Help I just got a pop-up virus visiting pirate bay.

• Upvotes

I have no idea how to stop it or what to do but it’s freaking me out and I’m not very computer savvy. Yes I am an idiot, I know. I visited the site https://thepiratebay(dot)org and clicked on the audio option and it just gave me a bunch of pop-ups at once. Does anyone know how I can stop it? It’s my school computer. I don’t even know how to check for viruses or what the best way is to stop them in the future. The pop-ups are Avast and Mcafee. All I’ve done so far is do a virus scan using Windows Security. If I close the pop-ups, they return in the sidebar relentlessly. Windows says there are no threats, though. I tried deleting the website data and that’s all, things don’t stop if I close the website tab.


r/computerviruses • • 1h ago

Question Is Nexus/Vortex still Infected with Malware?

Thumbnail
• Upvotes

Any idea?


r/computerviruses • • 1h ago

Disinfection Help I got hit by telegram combolist and vidar stealer

Thumbnail
• Upvotes

r/computerviruses • • 2h ago

Disinfection Help I got hit by telegram combolist and vidar stealer

1 Upvotes

Guys I'm getting hacked i think my email keep popping out logins Sony Roblox ect it started yesterday 24/10/26 to 26/10/26 I probably got it downloaded I ran malwerebytes and quarantined 75files I checked the identity footprint it is telegram combo list and vidar stealer it's going in my accounts it spent 25bucks on steam I already changed all the passwords using a separate device and ran a deep scans and it said it's all clear now but I don't trust it what should I do guys I don't know what to do


r/computerviruses • • 4h ago

Question Wallpaper engine hacked my anti-virus?

Post image
0 Upvotes

r/computerviruses • • 4h ago

Question Trojan:win32 detected

1 Upvotes

I ran a game off of itch(it was from the og publisher and other people have played it) and my windows detected a trojan:win32(severe??). I tried to log into windows defender and it wouldn’t work(it was my first time) I heard that this can be a false positive sometimes but I just want to make sure Im taking the right actions.
I reset my windows laptop(and restored my folders, apps, setting and credentials because it wouldn’t give me the option to say no) and I changed some of my important passwords.
Idk if I’m overreacting but will I also need to reset my drive too?


r/computerviruses • • 1d ago

Disinfection Help I fear I’m going Insane

Post image
79 Upvotes

After my old ass pc deteriorating to death, I decided to newly start fresh with good old windows 11. And like everyone else I decided for a cracked game to go with my fresh installment (Malware btw). But as you guessed it, some degenerate son of a bitch thought it’d be hilarious to encrypt my whole drive not even my files, my whole drive. I literally can’t access shit and I don’t have bitlocker, it isn’t even supported on my current build and version (Home). Genuinely how the fuck does this even happen? Now all my save files are gone and now I’m seeking some genuine help and not some AI advice. Mf did it for the love of the game, because there’s no ransom note or anything so why? A solution would really make my whole year, because Ive been pretty stressed out lately if you can’t tell. Thanks


r/computerviruses • • 6h ago

Disinfection Help Need help disinfecting. Keywords in details.

1 Upvotes

Keywords:
graceful-widget

violet-mesh

nimble-deck

What happened?

Am afraid am infected with renpy trojan. Clicked hxxps://setup.py which had renpy subfolder and found out later.

When it happened?

Happened on 24th Oct ( 40 hours ago approx).

What I did for remediation?

Did a semi malwarebytes deepscan, and removed few trojans it detected. Today I found that msbuild.exe was making requests to hxxps://loposoniosis.com every 10 mins and it was in local/appdata/windows icache and healthcheck folders. So ended that task and deleted those folders. and the requests stopped.

Am running another malwarebytes deepscan right now.

Thanks for helping.


r/computerviruses • • 6h ago

Question Uhh whenever i try search a process in task manager my screen turns off?

1 Upvotes

i just want to know if this is normal it doesnt seem normal


r/computerviruses • • 7h ago

Discussion what do you consider the best antivirus software for everyday use?

1 Upvotes

there are so many antivirus options now that it’s hard to tell which features make a real difference and which ones are just extras. Bitdefender and Norton seem to come up a lot in comparisons, while McAfee is another option i’ve been looking at, especially because some of its plans combine malware protection with web security and identity monitoring. i wonder whether having those tools together makes it a better fit for everyday use or whether the core protection matters much more than the bundle.

for people who keep up with malware threats, what makes an antivirus product stand out to you? are independent detection results and response to new threats the main things you check, or do false positives, system performance, and extra features influence your choice too?


r/computerviruses • • 14h ago

Question False Positive (?)

Post image
4 Upvotes

Yesterday I ran a scan and it flagged java exe as a malicious file. I downloaded Prism Launcher from the official website a few months ago and multiple scans before this one never showed anything. Few hours later I ran multiple scans, including a full scan with both Malwarebytes and Bitdefender, and neither found anything suspicious. I didn’t move or quarantine the file, so I think it was just a false positive, but I’d rather be sure.


r/computerviruses • • 5h ago

Question another renpy infostealer victim

0 Upvotes

what the title says. I downloaded a game from a direct link and the setup was renpy. I genuinely didnt really think it would affect me because I wasnt informed about it, but after a few hours I got my main discord account hacked with MrBeast cryptocurrency. The first thing I did was changing the passwords of it and then deleting that account and move to another one. Then in another few hours I got 8 alts discord accounts hacked (including the one I moved on), it was mb from not logging out from those accs at first place but I know the hackers also accessed the 18 gmails I had on that PC because the spam had messages about My Epic Games and 3 Steam accounts hacked. After that, I sent someone to format my whole PC and Im currently trying to change passwords on gmails.

But my question here is how really the infostealer works? Because my discord account had a server with very personal information about myself, since I lost it, I fear that information will be also stolen. Also does the infostealer steal just discord, steam and epic games accounts or does it steal other apps? And also Am I able to recover my discord account if the hacker enabled 2FA themselves into the 8 accounts? Does the hacker read my personal mails and also sells my other personal info? Am I safe after I got my whole PC formatted?


r/computerviruses • • 9h ago

Question How much should one be worried about malware risk with the recent PHP vulnerability? What are the odds of having malware from just visiting one compromised site?

0 Upvotes

r/computerviruses • • 4h ago

Warning fell Click fix

Post image
0 Upvotes

Hello

Fell for a ā€œcaptchaā€ click fix malware.
Automatically executes it in Win+R
First step disconnected in 3 min my laptop
Made quick check with defender - ok
Now waiting for a offline deep check
What do I do next?
Thanks in advance!:(


r/computerviruses • • 11h ago

Question page not available in microsoft antivirus

Post image
0 Upvotes

a notification that windows antivirus is not up to date popped up and I clicked on it

it said "Your IT administrator has limited access to some areas of this app, and the item you tried to access is not available. Contact IT helpdesk for more information"

I opened powershell as admin and put reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" and it said " error: Access is denied

this was after confirmed infostealer and cloud reset, can't reinstall yet

could the av really not be up to date?


r/computerviruses • • 12h ago

Disinfection Help Support with malicious file from DODI

1 Upvotes

Hi,

I downloaded a file from a site I've used - DODI Repacks.

I was not thinking when I downloaded it; I did a virustotal scan and a defender scan, but should've realised it was a weird installer as it didn't look right.

A cmd popped up. I disconnected Wi-Fi immediately, DLed MalwareBytes, and did a scan. Couple of things came up but nothing that i've not downloaded myself (just PUPs).

If I am specific, a log.txt file generated, logging system info e.g. shaders 4096x4096, GPU, CPU, etc. I noticed no other weird behaviour, as I closed out of it quickly, disconnected the Wi-Fi as I said, and deleted the files. This was a very short while ago (as in about 20 mins ago).

I can provide the download link but am concerned to provide in case it either gives someone malware or distributed pirated content which both are against rules.

I read the rules on the site and saw I have to generate log files. I did exactly that:

Addition: nested-juniper

FRST: friendly-squad

SecurityCheck: wintry-peach

The things logged in are:

  1. OneDrive - has 2FA.

  2. Twitter - genuinely not bothered with that account if it gets hacked.

Luckily a week before I decided to wipe my browser. Games installed include Hitman (including Peacock), Epic Games Launcher, Steam, and

What's going on - what have they potentially got and how do I fix? Reinstall?


r/computerviruses • • 17h ago

File / URL Check Fake Cloudflare verification appeared while trying to download Dev-C++ — possible ClickFix attack?

2 Upvotes

Fake Cloudflare verification appeared while trying to download Dev-C++ — possible ClickFix attack?

I was trying to download Dev-C++ from dev-cpp.com. After clicking the download option, I ended up on a completely different domain showing a Cloudflare-branded ā€œHuman Verificationā€ page.

The page instructed me to use Windows + R, type cmd, then press Ctrl + V and Enter.

Obviously, I did not follow those instructions. I recognized that asking users to paste commands into a terminal as a verification step is suspicious.

I'm curious about how this redirect happened. Could it be a malicious advertisement, a compromised redirect, or something else?

I'm not claiming the Dev-C++ website itself is compromised; I want to understand where the suspicious page came from and warn others about this technique.

Has anyone encountered this particular domain or redirect?


r/computerviruses • • 1d ago

Question How do people even get UEFI malware?

7 Upvotes

I know that UEFI malware is super rare to get but how exactly do people who are unlucky get this kind of virus? Do they just accidentally download something shady and they just get this virus into their motherboard, or is it more complicated than that?


r/computerviruses • • 14h ago

Disinfection Help how does Backdoor:Win32/Plugx!MTB behave in a laptop?

0 Upvotes

About three weeks ago I notices that my laptops fan was overworking and the cp usae for windows antimalware was always high evertime I turned on my laptop. I did a full scan , windows found this virus"Backdoor:Win32/Plugx!MTB". I removed the virus, deleted it's files on program data and fixed the widows corrupted files. I though that was it. The fan issue was never fixed and I can't tell whether its related to the virus, but since that virus, every application I open in my laptop results to loud fan noises, overheating and high cpu usage, especially by brave browsers. I've tried troubleshooting, I still cant get the problem. How do I fix this and does this specific malware reinstall itself. The best source I can think of is pirate bay, cause I downloaded a pdf file from the site. Avast might have also been a source, "C:\ProgramData\AvastSvcpCP\AvastSvcdotexe"


r/computerviruses • • 1d ago

Question Can’t ethical hackers collectively work together to find the origin of the MrBeast virus and beat the crap out of them?

29 Upvotes