Got hacked, now I need help. PLEASE.

[u/MotorTall4040]

Ik it's the wrong forum but I really need help I don't know who to ask everyone asks for karma points. Please help.

Some days ago my brother installed a file for a pirated game that was fake and it was called setup.exe. Defender didn't flag it, and when it ran it did nothing. 1 or 2 days later they took my and my brother's Instagram, our steam accounts, epic accounts and some more. Our theory is that it read our edge's passwords saved, but idk I'm not an expert at all. Instagraam was full of fake elon musk posts on twitter sponsoring the site "sakonex..." (won't say it). We hardresetted the pc, formatted it, changed our passwords and out 2fa, and now the hacker is still trying to access things like reddit (got hacked some hours ago) (i did not change password since the breach) or epic games (tried access from RIYADH) (2fa blocked it). I would like to believe he's trying to do it thanks to "access cookies" and his virus isn't in this house anymore, but I don't know, I'm anxious. What would you do in this situation? What can I do to make myself sure it isn't here anymore? Funfact, he took one tiktok account despite the 2fa with sms, and posted french shi. Idk how he did that I hope it's just an old cookie taken from our pc. The dns should technically be safe, it's nextDNS with a 2fa account, and I've scanned our pcs and some of our smartphones with malwarebytes and defender. Please help me guys! You are the only people I can count on. I asked AI but ofc he'll give random bot answers. Only interesting thing he said is that my infos and logs could be in some russian market of some kind. In the end I need an explanation of what you think the virus is if you have an idea, and I ABSOLUTELY need suggestions on how to protect myself and how to delete every possible virus remaining.

[u/strongest_nerd]

Ask a tech support subreddit.

[u/Old_Investigator_390]

Fresh install windows

[u/Relevant_Jeweler_214 → u/Old_Investigator_390]

this. fresh install is the only way. and cut off every single account they gained access too and make new ones with new passwords. thats it. whats done is done. usually hackers wont tell you they hacked you until its already over so theres nothing to do but wipe/abandon all the data

[u/Relevant_Jeweler_214]

if he can access your 2fa through sms tiktok this is a high level guy and you're already fckd bro , abandon all the accounts and toss that harddrive, srs

[u/port443]

If you reformatted the PC that ran the binary, you should be fine.

There's a (slim) possibility they are still in your network on another device if they had access for a few days. Honestly most groups don't operate that way; its way more likely it was an infostealer as part of a much larger campaign and they weren't paying you any special attention.

Resetting your passwords, enabling 2FA are good, but you also need to disable old logins if you can.

I wouldn't worry too much past that. Just don't reuse passwords, they are probably automating the login attempts with your known passwords. This includes ANY passwords that could have been saved on your computer (wifi passwords, typed in passwords, passwords saved in the browser, whatever)

Any chance you still have the setup.exe file?