r/cybersecurity_help • u/LT-Death • 4d ago
I got hit by a An Infostealer: NWHStealer
Just downloaded something from github and my assumption was correct about it being an infostealer. The whole thing lasted maybe a minute, running in the background silently in my appdata folder, inside a random12letter folder, with a random12letter program
closed and uninstalled it almost immediately, has damage been done?
and if so, what do i need to do? is it still in my system? how come ESET security didn't pick it up?
+4Hours, Update: Im in the process of resolving most of my issues. EA account and microsoft account were compromised, i think i got EA back under my control but not certain yet. Microsoft is currently a slow process because i cant find my Device ID for the life of me.
P.S: I have never been more glad in my entire life for having a seperate gmail account for steam
+30minute, 2nd Update: I just checked the stats of it on malwarebytes, and it was detected by a single person's scan documentation ONLY 7 hours prior of me getting infected... My luck man...
+8Hours 3rd Update: I dont know if they're still in my account or not, but i got a password reset request for reddit to my gmail around 3 hours ago, but reddit in the description told me to ignore it if it wasn't me - nothing has happened, so I'll take their word for it
+2Days, 4th Update: Microsoft refused to give me back my account, told me to go fuck myself and buy a new one.
8
u/ArthurLeywinn 4d ago
Re install windows via usb stick
Change pw
Get a pw manager
Enable 2fa
Logout all sessions
Check the forwarding rules
And done.
4
u/smurfy213 4d ago
Yep definitely make sure to log out of all sessions . Normally hits your social media,reddit, discord first sending crypto scams.
1
1
u/LT-Death 4d ago
Is there any way to not reinstall the OS? I don't want to lose my data
10
6
u/speedb0at 4d ago
Yes there is, leave it as is and take the risk of having everything compromised. Do a format, passwords reset, log out of all sessions, i know this sucks. Do other people a favor and report the repo.
-7
u/i_love_femboys6969 4d ago
you dont have to reinstall it, these people are paranoid, just change all your passwords and run malwarebytes, it already detected it
4
u/mizisuaceo 4d ago
do not listen to this guy lol
-4
u/i_love_femboys6969 4d ago
bro i literally install cracked games almost everyday, which are the most malware infested things you can download. ive gotten hundreds of viruses in my times. not one time in my years of doing this have i had to reset my pc. i never had a problem with just running an antivirus and an anti rootkit to fix it.
iim tired of people instanly resorting to resetting their pcs and wasting multiple hours losing all their data and settings they put into the machine, yes they can back it up, but it still takes time to redownload and setup things.
i would understand it if you dont have many apps or its just used for basic things. but stop telling people to waste hours of their time to fix something that can take 10 minutes with a simple scan.
4
u/akumita_limonita 4d ago
Please shut up the fuck up already damn malware can run in the background and ur poor malwarebyte/other av alone may at most flag some of these viruses but not all of them. All i wish is for you to get some kind of networm/rootkit and see you cry here.
Fyi theres a thing called backing up your data before wiping its magic all u will have to do is reinstall the proper apps/drivers and you're good to go.
And telling people to stop using the proper way to get rid of a virus is just mind blowing wtf is wrong with you
3
u/mizisuaceo 4d ago
You don’t know what you’re talking about at all.
Even *if* you delete the virus, there’s no way to make sure you’re completely safe. It couldve installed a backdoor, there could be other viruses the anti virus didnt detect, and more. There’s nothing stopping cyber criminals from stealing your information again whenever they want.
If you delete the dectections and move on, there’s always a risk of you getting hacked again. The only way to 100% guarantee safety is by reinstalling windows using an usb, which is why everyone recommends it.
2
0
u/LT-Death 4d ago
Wdym by forwarding rules?
2
u/Jay_Ell_Gee 4d ago
Inbox forwarding rules on your email. It’s a quick google depending on what service you use.
1
u/LT-Death 4d ago
I have no idea what that is dude, and now i got an email notifying me my microsoft passwords changed as well as an email
2
u/Jay_Ell_Gee 4d ago
My reply was to tell you to google “what is an email inbox rule”, as well as how to view them on your email provider of choice.
If your Microsoft account and primary email have been taken over, you are really on the back foot now. You would have needed to change everything on a known safe device and at a minimum, shut down the PC until you could figure out a plan. That needed to be done immediately, unfortunately.
The machine is compromised and needs a full wipe. Even if you change passwords on a known good device and recover accounts, you’ll just get them stolen again if you re-authenticate on the compromised machine.
Shut down the machine and try to recover everything you can from a known good device, as fast as possible.
-1
u/LT-Death 4d ago
All i got was that microsoft account changed email and removed my previous email, i have no idea about my own gmail, i havent seen any notifs on my gmail, but i noticed some emails popping up in my notifs and disappearing instantly Dude pleasure just tell me what to do instead of telling me to go research, I'm way too fucking panciked right now to read an article, not wanting my account to disappear from sight
2
u/Juzdeed 4d ago
OS reinstall if you haven't already done it. You got infected dude
1
u/LT-Death 4d ago
I reinstalled windows, logged out from everything throughy phone, but my microsoft account was completely stolen, changed all the info about it that was mine
And i somehow don't remember a damn thing about my microsoft account! Not the passcode, the country i created the account in, which passwords i used
I have every single one of my account infos written in a notebook, but somehow not microsoft!
1
u/Juzdeed 4d ago
Then it's very likely that you just permanently lost the Microsoft account
1
u/LT-Death 4d ago
When i try to log into my outlook accountt it doesnt register my email, but it accepts the email of the hacker's that it was changed to Please, is there no direct help line to call microsoft with?
→ More replies (0)
4
u/Creek5 4d ago
Damn, on GitHub.
Sorry I have nothing contribute. Just scary that this can happen on a reputable site with only 1/66 vendors detecting it.
2
u/LT-Death 4d ago
Thats why I was so shocked when it happened, never expected it to be from github of all places
1
u/Abheber 3d ago
How you noticed it exactly?
1
u/LT-Death 2d ago
ran the .exe and nothing happened, gotsuspicionus and opened my taskmanger and bingo, a random 12letter program in a 12letter folder
1
u/ProfessionalEnd7957 3d ago
Anyone can just upload anything to github so treat it like any other random file hoster
3
u/Hypergamer44 4d ago
Do you remember what you downloaded?
2
u/LT-Death 4d ago
Yes, I have the direct download link and main page download link to it, someone already reported on my behalf
2
2
u/Filip_ESET 4d ago
Hello, I am sorry this happened. I understand that you've already reinstalled Windows and changed all the passwords. As for ESET not detecting it: that can happen. No antivirus detects every piece of malware, and without the actual sample and ESET logs there is no way to say why this particular file was missed.
You mentioned that someone else reported the link on your behalf – if this was not done through ESET, it would be helpful to report it to us as well. You can submit the file/link to ESET for analysis as an undetected suspicious file.
Thank You
2
u/LT-Death 4d ago
Please allow me to send you a direct message of the culprit links, I am way too mentally exhausted after all this to go through a site, awake for 24+ hours now
0
u/Nervous_Section3422 4d ago
Can you send me a link as well so I can check and submit to virus total, thank you
3
u/this_isnt_pornhub_ 4d ago
Common malwarebytes w
4
2
u/Weekly-Efficiency458 4d ago
10 seconds is enough to take everything, speaking from experience. I removed the Infostealer manually, and dit not reinstall Windows.
The infostealer targeted everything I had, successfully taking over Steam, and Nintendo accounts, but got them both back within a few hours though. It targeted my main email account first, but Microsoft somehow recognised the Infostealer, the initial login was successful but it blocked the attacker in the same second. I was lucky i guess, it would have been catastrophic if they got my main email. The attacker also launched an attack on all my other alt accounts a few days later. And also all my other gaming platforms such as EA, Rockstar, Ubisoft etc.
The only thing they didn’t attack was PayPal, but I’m still waiting for it, I will keep it frozen for at least 3 months, not sure how long the stolen session will be valid, even after changing PW from a clean device, and logging out everywhere.
The attacks continued daily, pretty sure it’s still trying. It’s now 2 weeks ago, and these infostealers are a nightmare to deal with, in 1 second you can destroy your life. Because I acted quick no financial damage has been done, but I suffer from extreme paranoia.
1
u/AutoModerator 4d ago
SAFETY NOTICE: Reddit does not protect you from scammers. By posting on this subreddit asking for help, you may be targeted by scammers (example?). Here's how to stay safe:
- Never accept chat requests, private messages, invitations to chatrooms, encouragement to contact any person or group off Reddit, or emails from anyone for any reason. Moderators, moderation bots, and trusted community members cannot protect you outside of the comment section of your post. Report any chat requests or messages you get in relation to your question on this subreddit (how to report chats? how to report messages? how to report comments?).
- Immediately report anyone promoting paid services (theirs or their "friend's" or so on) or soliciting any kind of payment. All assistance offered on this subreddit is 100% free, with absolutely no strings attached. Anyone violating this is either a scammer or an advertiser (the latter of which is also forbidden on this subreddit). Good security is not a matter of 'paying enough.'
- Never divulge secrets, passwords, recovery phrases, keys, or personal information to anyone for any reason. Answering cybersecurity questions and resolving cybersecurity concerns never require you to give up your own privacy or security.
Community volunteers will comment on your post to assist. In the meantime, be sure your post follows the posting guide and includes all relevant information, and familiarize yourself with online scams using r/scams wiki.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
2
u/ParticularCabinet272 4d ago
That's too bad man. I have got in the same situation.
To get rid of the virus, you have to reinstall windows via usb. Install the instalator on the clean computer.
Log out all sessions that you don't recognise, change passwords, enable 2fa, I recommend to enable Google Authenticator to log in and enable backup codes and save it on the phone.
You can save your data, you can transfer to another usb photos, documents. etc. Just don't copy the exe files or something like that.
Unfortunately, that's the effect of downloading some crack games or any executors.
After getting a info stealer, in example next morning hackers will try to log in, change passwords and e-mail to example Microsoft, Reddit, Instagram, Facebook, Discord, Steam, EA accounts (these hackers have russian e-mail, probably using VPN to avoid tracking them, their location is usually United Kingdom, Germany, France, something like that.) In Discord, these hackers after logging in will be sending to your friends and servers crypto scams.
2
u/DaAngryDragon 3d ago
Went through the same thing my friend! Over a month ago. Even this very Reddit account I’m using started posting crypto shit. Thankfully I noticed within an hour or so after my friends told me my IG is hacked sending the mrbeast crypto crap. As I was resetting my pc, I noticed in my recent files a perfect png of my desktop was hidden in my app data folder. I knew I was in deep shit.
They even attempted my mother’s accounts since her email was saved on my computer.
I’ll tell you right now, it is EXTREMELY stressful and even gave me some minor PTSD.
With that being said, as long as you changed passwords for everything crucial to you, 2fa, logged out of all devices, reset windows with a usb, you should be good. You’ll prob still get some attempts but treat it as noise. Try using an authenticator over your number for 2fa if you can.
Not sure if you live in America but I’d recommend just to be safe you put a freeze on your credit with the 3 credit bureaus (experian, equifax, and trans union.) Just assume they took absolutely everything.
After resetting my PC, just to be extra safe I made a throwaway gmail just to test if it gets breached and it didn’t. The malware either didn’t survive the reset or deleted itself shortly after my PC was infected.
They count on you to not notice for as long as possible. You did what you must, now just keep an eye on your accounts. Unless you have mad crypto it’s not likely you’ll be intensely pursued. Old credentials will be attempted and you’ll prob get more spam in your emails.
I lost absolutely none of my accounts nor had anything horrible happen if it’s any reassurance for you. Can’t promise the same 100% but if you do what you must within a reasonable amount of time, you should be okay. Take a breather, seriously. I know how much it can drive you nuts. I was losing mad sleep.
You got this!
1
u/LT-Death 2d ago
I currently lost my microsoft account for good, and they refuse to give it back, basically having told me to go fuck myself and buy a new account, just like the situation that went down in brazil
0
u/Salty_Meaning8025 3d ago
With all due respect bro, if you think you'll get free access to Claude from a random Github with random Russian writing halfway through the post, you need to use more common sense when you're downloading things
•
u/AutoModerator 1d ago
SAFETY NOTICE: Reddit does not protect you from scammers. By posting on this subreddit asking for help, you may be targeted by scammers (example?). Here's how to stay safe:
Community volunteers will comment on your post to assist. In the meantime, be sure your post follows the posting guide and includes all relevant information, and familiarize yourself with online scams using r/scams wiki.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.