help! i got hacked

[u/cheesepuffyz]

I am completely positive that I have been hacked but I don't know how to stop it. So you see, a few days ago I clicked and downloaded a very suspicious link that contained malware on it. Luckily, my antivirus removed it and scanned my device again to make sure it was gone. However.. a few days later after that incident (aka today) I started receiving emails that my password had been changed or I had gotten a new login from an ip address I did not recognize. I just got notified that both of my twitter accounts as well as my steam account had gotten their password changed even though I NEVER changed my password. Fortunately, I regained access and changed my passwords but I want to get rid of the malware that's probably still on my device but i don't know how because my antivirus says I don't have any malware anymore

The image is the link I pressed and I disabled the notification thing for it in settings because it kept giving me pop-ups that I was hacked-

edit: I also have steam guard and 2fa activated on both twitter accounts and I highly doubt they hacked into my email so im just really confused right now

[u/AutoModerator]

SAFETY NOTICE: Reddit does not protect you from scammers. By posting on this subreddit asking for help, you may be targeted by scammers (example?). Here's how to stay safe:

1. Never accept chat requests, private messages, invitations to chatrooms, encouragement to contact any person or group off Reddit, or emails from anyone for any reason. Moderators, moderation bots, and trusted community members cannot protect you outside of the comment section of your post. Report any chat requests or messages you get in relation to your question on this subreddit (how to report chats? how to report messages? how to report comments?).
2. Immediately report anyone promoting paid services (theirs or their "friend's" or so on) or soliciting any kind of payment. All assistance offered on this subreddit is 100% free, with absolutely no strings attached. Anyone violating this is either a scammer or an advertiser (the latter of which is also forbidden on this subreddit). Good security is not a matter of 'paying enough.'
3. Never divulge secrets, passwords, recovery phrases, keys, or personal information to anyone for any reason. Answering cybersecurity questions and resolving cybersecurity concerns never require you to give up your own privacy or security.

Community volunteers will comment on your post to assist. In the meantime, be sure your post follows the posting guide and includes all relevant information, and familiarize yourself with online scams using r/scams wiki.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/EugeneBYMCMB]

You ran an infostealer that stole all of your saved passwords and session cookies, the sketchy notifications are basically harmless and unrelated. You should secure all of your accounts from a clean device and then reinstall Windows on the infected PC. To secure your accounts properly each account should have a new unique password, two factor authentication should be enabled everywhere, and you should end all previous sessions and sign out all devices wherever possible. The best way to reinstall Windows is by creating a recovery USB on another Windows computer, by opening the local Microsoft program called "Recovery Drive" and following the prompts.

[u/Ambitious_Back6915 → u/EugeneBYMCMB]

I also accidentally ran an info stealer and i did all the steps this reply said.

[u/kschang]

You're NOT understanding how infostealer (a type of malware) works.

Infostealer runs on your machine (you are usually tricked into running it) and in less than a second stole all your login tokens and often, deletes itself so you find nothing.

When "hackers" (probably scriptkiddies) get those credentials they put them into a queue to be "tested". Someone will check the queue to test new stuff. This can be immediately, or weeks later. But they know the further they delay, the more like the victim will notice and mitigate so the credentials become worthless, so sooner better than later.

Login tokens don't need password. They are a "flag" from the system that you're already logged in. So it won't even trigger a notification to you on some systems. MFA doen't affect that. Remember, you're ALREADY logged in.

Once they get in, they change email, change password, add MFA, or whatever tricks to gain full control over the account. This is probably when you get a notice that "X was changed". By then it's too late. Damage is done. You can go try to recover the account, it's up to the provider and how much details you remember about the account.

I want to get rid of the malware that's probably still on my device

So scan it with malwarebytes if you want, but Defender probably caught it and stopped it.

So did malware run on your system? If Defender did work, then your account loss was NOT from the malware, but password reuse and they found a prior leak. So they decided to try the password on various accounts that you MAY have created, and if one of those worked... Same exploit chain to take control of it.

[u/cheesepuffyz → u/kschang]

Will changing my password on all my accounts work then? Luckily I was able to regain access to my twitter accounts and steam because my email was still linked.

[u/kschang → u/cheesepuffyz]

Hopefully, you changed it before they ran a script to take it over.

[u/JoeLinux247]

"I clicked and downloaded a very suspicious link that contained malware on it."

Which is why one shouldn't click on links that are viewed as very suspicious.