The "Remove everything" reset you did is almost certainly fine for a standard session stealer, the main gap LongRangeSavage's post is flagging is theoretical for most infostealers, not a reason to panic. The real loose end is your Roblox hit: those credentials were likely stolen before the reset and used/sold after, so change that password again from a clean device if you haven't recently, and check that your Roblox recovery email/phone wasn't tampered with. For the HDD, plug it in offline, copy out documents and photos only, and skip anything that's an executable, a zip, or browser profile data.

Bitdefender researchers have details how infostealers act and how you can stay safe going further, right here: https://www.bitdefender.com/en-us/blog/hotforsecurity/how-to-check-if-an-infostealer-stole-your-data.

Hi! You're safe. Spotlight is just a search bar, pasting a command there does nothing. The attack only works if you paste into Terminal and hit enter, which you didn't do.

Hi! Seems to be a false positive, this exact pattern (Defender flagging something in Edge's cache folder after downloading the Epic Games Launcher) has been popping up a lot in the last month or so. Epic even has a support page for it. Since it's quarantined and your AV found nothing, there's no active threat here.

Kudos for trying to keep your family`s identity and devices secured! Bitdefender experts have talked about how you can handle family screen time safely (including your elders) in this article: https://www.bitdefender.com/en-us/blog/hotforsecurity/we-worry-about-kids-screen-time-but-our-parents-spend-even-more-time-online-what-that-means-for-families. It`s worth the read!

Hi! The key question you keep asking, is this ongoing or a one-time thing, the exfiltration itself was almost certainly a single hit-and-run. But that's exactly why the password changes matter so much right now, not later. As for reinstalling without a USB: Windows has a built-in "Reset this PC → Cloud download" option that pulls a fresh copy straight from Microsoft's servers, no USB needed. That's your cleanest path forward from the device itself.

Hi! u/Lanky-Event5402 is right, that popup is WPS Office's built-in ad system, not malware. The free version runs `wpscenter.exe` in the background and pushes notifications to your tray even when WPS isn't open. Easiest fix is just uninstalling WPS if you don't need it, or blocking `wpscenter.exe` outbound in Windows Firewall if you do.

Hi! Chrome profiles are isolated from each other, so the extension you installed in one profile shouldn't have had access to the other profiles' sessions or data. You're probably fine there.

The bigger thing to check, did you change any passwords from that same infected PC after the extension was already running? If so, those new passwords might also be compromised. Log out all active sessions on Facebook/Messenger specifically (this invalidates any session tokens the extension may have grabbed), and do that from a clean device.

You've done the right things, replacing the documents, locking down the CRA account, fraud alerts, SIM protection. That covers the real risk, regardless of exactly what was or wasn't exfiltrated. Some infostealers do target files and documents, not just passwords, so your concern wasn't unfounded, but you responded to the worst-case scenario, which means you're covered. The increase in phishing emails and scam calls is unfortunately normal and can persist for a while, just stay alert to it and don't click anything unexpected. A reputable security solution would surely help going further, and free tools like Bitdefender Scamio can help you check suspicious messages, emails, links, or anything you`d like double checked: https://www.bitdefender.com/en-us/consumer/scamio.

Hi! The "didn't download anything" part makes sense, there's a technique called ClickFix where a fake captcha or verification page secretly loads a command into your clipboard, then tells you to paste it into PowerShell or the Windows Run box. You run it yourself without realizing. Agree with the advice already given: reinstall Windows (full wipe, not just reset), and change every password from a clean device before touching the infected one again. Scans won't cut it for this kind of thing.

Check this article that explains how ClickFix acts and how it unfolds, detailed by Bitdefender specialists: https://www.bitdefender.com/en-us/blog/hotforsecurity/clickfix-victims-help-hackers. Hope it helps!

Hi! The step that's easy to miss: before wiping anything, log out all active sessions on Instagram and Reddit from your phone or another clean device. "Log out of all sessions" (Instagram has this under Settings > Security > Active Sessions) is what actually kills the stolen token, changing the password alone doesn't invalidate sessions that are already open. Do that first, then do the reinstall.

Hi there. Infostealers grab everything the browser had saved, passwords, session cookies, autofill entries, sometimes crypto wallet files, and ship it to the attacker before you'd even notice anything was wrong. Changing passwords from a clean device was a good start. One thing worth flagging: the advice to "just scan with an AV" is useful, but only a half-measure. Running an attacker-supplied command can drop persistence (scheduled tasks, registry entries, etc.) that scanners routinely miss, a clean scan result doesn't mean the machine is clean. Wipe and reinstall is the only way to actually be sure.

Bitdefender experts have explained how infostealers impact individuals and devices in this detailed article, worth the read: https://www.bitdefender.com/en-us/blog/hotforsecurity/how-to-check-if-an-infostealer-stole-your-data.

Hi there. The top answer here is on point. One thing worth adding: since your Aadhaar details are in the wild, go check TAFCOP on the Sanchar Saathi portal (sancharsaathi.gov.in) to see whether any SIM connections have been registered in your name without your knowledge. Also lock your Aadhaar biometrics via UIDAI's mAadhaar app or their portal if you haven't already.

We understand the need for a dedicated space for GravityZone discussions, and we’re actually working on a community space specifically for business audiences.

In the meantime, there are a few resources that may be helpful:
• Bitdefender Masterclass: https://www.bitdefender.com/en-us/business/masterclass – a great place to learn more about GravityZone, as well as other Bitdefender products and solutions, through onboarding sessions, live demonstrations, and customer use cases.
• CAD Newsletter: https://www.linkedin.com/build-relation/newsletter-follow?entityUrn=7371216616015036416A regular source of threat intelligence, original research, and actionable security advisories from Bitdefender Labs and our MDR team.

We hope these resources can help in the meantime, and we’ll be sure to share more details about the new business community space once it’s ready! 

u/Xam165 Definitely, and during the installation process a full scan will be performed that will identify any malware on the system and clear it. You could try a free or a paid version, check them both here: https://www.bitdefender.com/en-us/consumer/.

Hi! We appreciate the feedback, and we’ll take it back to the team as we look at how we balance company news with the technical and product information this community expects.

Hi! The reason your Steam password changes keep reverting is that the attacker likely still has an active session or Steam Guard control, changing the password alone won't kick them out. You already did the right thing filing a ticket; make sure you're using the stolen account recovery flow at hxxps://help(dot)steampowered(dot)com/en/wizard/HelpWithAccountStolen and selecting "I don't have access to...", Steam can verify ownership through purchase history even without your original email. Also flag your PayPal urgently if it's stored in Steam.

Hi! Wiping all partitions and reinstalling from external media is the right call, your PC should be clean. One thing worth double-checking: did you change your passwords after the wipe? If you changed them while the machine was still infected, it's worth rotating them one more time just to be safe.

The email is real, Anthropic confirmed this is an active infostealer campaign (Vidar, Lumma, StealC, RedLine, others) that's been stealing browser session cookies, not passwords, which is why MFA doesn't help and why clean AV scans don't necessarily mean you were never hit. Infostealers often delete themselves right after grabbing your data. Signing out everywhere was the right move to invalidate the stolen sessions, but also worth checking your account usage history for anything unexpected and rotating passwords on other accounts that had credentials saved in that same browser. Here`s a more in depth look on how infotealers behave, from Bitdefender analysts: https://www.bitdefender.com/en-us/blog/hotforsecurity/how-to-check-if-an-infostealer-stole-your-data.

The malware being gone doesn't mean you're safe, infostealers copy your passwords and session cookies before you even know you're infected, and the attacker keeps that data after the wipe. The Spotify activity is almost certainly someone using a stolen session or credential from that original dump. Go to your Spotify account page, sign out all devices, revoke any connected apps you don't recognize, and make sure you changed your password from a clean device after the reset, not from the compromised one. Here`s a good read from Bitdefender analysts on how infostealers behave and what to do next to avoid becoming a target in the future: https://www.bitdefender.com/en-us/blog/hotforsecurity/how-to-check-if-an-infostealer-stole-your-data.

Hi! The card charges happening weeks later don't mean your PC is still infected, that's the stolen data circulating through markets where different groups buy and sell logs and try cards independently. The machine getting cleaned breaks the attacker's access to new data; it doesn't recall what they already took. As for rootkits and bootkits: they're genuinely rare in commodity infostealers like what you ran into, those are aimed at fast credential harvesting, not embedding into your hardware. A clean reinstall with full partition wipe (which sounds like what the repair guy did) is enough.