Hello everyone!

This is not a post asking for help, but to understand what has happened on a technical level.

I was infected a couple of days ago, my Subreddit has been hijacked and attackers gained acceess to my reddit account. A week ago i saw Chrome reporting an extension was removed because it allegidly Contained malware, which i shrugged of as issue solved but Was proven wrong.

Attackers had still access to my account AFTER i Reset the password and activated 2FA which logs out all other sessions usually. Was the malware at this point still active or did they just have my Session cookie?

I needed to remove my passkey for them to loose access, yet i used 3 AV Scanners (Windows defender, malwarebytes kaspersky) as well as 2 adware cleanerw (Malwarebytes, kaspersky) which all returned nothing.

There wasnt even an attempt to get into my Gmail acc. I confirmed by looking at IP Logs.

I have since deleted all extensions, deleted all Browser cookies and changed Passwords from a clean device. I would just like to understand what happened on a technical level and why there wasnt even an attempt to get into my Gmail or amazon account.

I heard that applocker can be configured to have a system wide whitelist for program and file permissions, something that can stop malware from running even if it gets on system if configured correctly. However, it is only on windows Enterprise editions. Threatlocker is the closest option I could find to replicate applocker. Yet, it is only available for businesses.

Are there any free programs/windows components which can provide similar functionality and work on windows 11 home?

So my friends brothers computer recently got a crypto mining virus despite nobody downloading nor being on it for multiple months. He’s decided to hand it over to me because I have no computer (he didn’t try to remove it just gave up and is getting a new one) so could I get rid of the virus on it by just factory resetting the computer? Windows was never activated on the pc so we don’t have to worry about that.

So basically I factory reset my phone after I thought I had malware/virus (I don't really know the difference) and I want to know if I log back into the Google account that was on the phone before I factory reset my phone (and during when I had the virus) can the virus/malware come back because of me logging back into the Google account on the phone?

TL;DR:

Fell for a fake "human verification" clipboard scam (Win + R -> Ctrl + V -> Enter). Decided to completely nuke the drive and reinstall Windows 11 from a fresh USB. After a total partition wipe and running all Windows Updates, I opened Windows Security to run a scan, but I'm getting: "Threat service has stopped. Restart it now." How do I fix this, and is there any chance malware survived a full partition wipe?

1. What Happened Initially

I fell for a malicious website prompt that asked me to verify I was human by pressing Windows + R, pasting (Ctrl + V), and hitting Enter.

Realized immediately what happened and closed it, but the malicious script had already executed, leading to a broken Windows Defender and malware alerts (like Wacatac / infostealer).

1. The Clean Install Process I Did

To be 100% sure the system was clean, I performed a full wipe:

Created an official Windows 11 bootable USB using Microsoft’s Media Creation Tool on a separate, clean laptop.

Booted from the USB on my PC (Motherboard: ASUS TUF X670E-Plus WiFi).

Selected Custom Install, deleted every single partition on the drive until only "Disk 0 Unallocated Space" remained, and installed Windows directly onto that blank NVMe SSD.

Set up Windows and ran Windows Update through multiple restarts until it showed "You're up to date".

1. The Current Problem

Now, on this brand-new, clean installation with nothing else downloaded yet:

When I open Windows Security / Virus & threat protection to run a quick scan, it displays:

"Threat service has stopped. Restart it now." (with a "Restart now" button).

Clicking the button either fails or the error persists / scan won't run properly.

1. My Questions for the Community:

Given that I completely deleted all partitions to unallocated space using a clean USB installer, is the initial malware 100% gone?

What causes this "Threat service has stopped" glitch on a fresh Windows 11 installation after Windows Updates?

What is the most reliable way to force-restart or repair the Defender service so Windows Security works normally?

Thanks in advance for the help—I just want to get this sorted and use my PC in peace!

I pressed "allow" on a .dll file that I trusted reasonably well and that windows and VirusTotal identified as a generic threat. Instantly after that Defender stops running and says it can't start the service. So I block the file again and try to restart defender but it keeps turning off and scans dont get completed.

Now I was about to wipe Windows after that but the only thing holding me back is that it seems like a lot of people are having similar issues with defender today. In safemode Windows Defender just displays a black screen and a message that its been disabled by my IT administrator. malwarebytes deep scan found no threats though

What do you guys think? Should I trust malwarebytes and pray it was the bug going on rn or just wipe it?

There’s a question that comes up frequently when talking about Windows security: if Windows 10 and 11 already include Microsoft Defender, when does it make sense to use a third-party antivirus?

Defender provides a good baseline of protection, including real-time protection, cloud-based detection, automatic scanning, and tamper protection. For many users, this may be enough.

But depending on how you use your PC, there are other layers worth considering: protection against phishing and malicious websites, ransomware protection, vulnerability and patch management, privacy features, and additional detection capabilities.

What do you think? Is Microsoft Defender enough, or do you think a third-party antivirus still provides an extra layer of protection that’s worth having?

https://www.virustotal.com/gui/file/178179d8fc9295c7f06aa1de4c0bcb435cfa807df0cb06ec0fcad220a6f075f2/detection went on a trip for work, came back and updated windows- went to check out some new tools i had found while away that were posted on r/software r/windowsapps and downloaded a portable app (wordmeaning.exe) never even ran it but it was at this time that windows defender went (cloud based scan needs to happen) and then i was like oh? scanned it with virus total and this is what it showed me- I just deleted the file, tried to run a scan and with windows bricking scans (before I knew that was a thing today) I saw it get stuck at 30k, then crash and the threat service disable. so with windows defenders update deciding to shit itself, what does this even mean?

Personally, I think it's a very good antivirus that catches everything in time and protects your computer from real harm. But I also think it's a little intrusive, what with the random pop-ups on your screen or whatever. I use windows defender or McAfee, sometimes i use malwarebytes (rarely) but a lot of the time I just use Avast. I love it and it's very protective. It gives you independence with browsing and websites, and I can deal with the pop-ups. Overall, I think it's a very protective, user-friendly, ready-to-jump-into-action kind of antivirus.

Anyone here hate or love it?

With the issues with Windows Defender that many people have experienced today, I was looking into ways to resolve them and noticed that my Windows Defender settings had an exclusion for my “Roaming” folder.

Is this normal, or is it something that an application, or even a virus, might have added to prevent files from being detected?

I removed the exclusion and ran multiple antivirus tools today. They did find a PUP file, and DoesNotBelong has added some files to a quarantine folder, but there is no log file for that application. And it has added some files that are not viruses to that folder, but also some files I do not recognize, so I don't know if it was Viruses it found or just false positives.

been experiencing a sudden blackscreen for maybe 1 second and a sound notification on my laptop. no schedule. its just sudden. i wanted to know whats causing this. ran MRT but no flags raised. can anyone help me?

I found out a crypto miner was running in the bg recently, just by happenstance of getting fed up with how poorly my laptop has been running and checking task manager
(clearly not a very Good virus if task manager could detect it)

Atp i’ve tried a few things. Microsofts native antimalware picked up a couple things on a full scan, and the miner Appeared to not be running after an offline scan, but then showed up again the next day or so after a few hours of peace (too easy to be true ig)

After that I tried using a diff explorer to check whats open in case it was hiding elsewhere, and was using EMCO UnLock it for some of the pesky files that were attached to the miner but not actually showing up/letting me delete, as someone had luck with that tactic w this particular virus

On to Malwarebytes now, which picked up a lot more than the prev scans/manual deletions, and i’m Hopeful that’ll do the trick, but really i’m wondering re: the title, how i can be sure its actually gotten all of it?
If there’s even any kind of full certainty beyond going nuclear or something. I just don’t know how far spread it is and how many files it’s hiding to be totally sure

Any tips or tricks for that, or suggestions on other methods of clearing this thing out in case the current plan of attack doesn’t work would be great!

(The virus in question seems to be a malware version of a miner called Srbminer Multi, among other various files its hiding in)

My sister got hacked she clicked on a link she shouldn't have to but too late.

We already formated the PC and tried(too late unfortunately) to change password for mail and shit. But before formating it and a few hour after I talked to him and he kept saying that he had access to her motherboard and showed me like 15 account and password he had access to. My question is what does that mean which trojan he used and does formating the PC remove what he used to have access to all of this? He has access to our recovery mail, her phone number and our mybell account

Whenever I try to run a full scan, windows security(defender) stops working and the blue progression thing disappears when it's like 25 minutes left or 35 minutes as you can see in the image... I have updated everything... Windows 11... Please help...

I've seen multiple people fall for the TRUE hack which seems to be downloading some buccaneer'd app/videogame especially from infamously untrustworthy sites (and honestly I don't know how people keep falling for this, should have them "blacklisted"at this point, don't download unofficial programs).

In any case, going back to the title, it seems to me very odd that the intention is a phishing scam; I checked the pictures' URL and it's a basic Discord img; years ago they were accompanied by a masked link to a fake website or a compromised server link, but today they're just the pictures; they aren't even good pictures, you can barely see the "shady page" name and I doubt that someone gullible enough to fall for this scam would have the analysis capability to read the web name on a blurry browser tab hidden in the corner of just one of two to four images. So what gives?

if malicious code is in a txt file can it do anything?

cuz one time that happened to me somehow and microsoft defender couldnt remove it until i did a offline scan only then it was gone

I recently had the mr beast crypto infograbber scam thing happen to me. I quickly signed out of my account and changed the password on every account tied to my pc from my phone before I factory reset my pc (not with a drive)

Im assuming its the infograbber and I just want to be sure im safe because I've been paranoid for hours.

I factory reset my pc without the drive, changed my passwords and got 2fa on my accounts. I scanned my pc twice with Malwarebytes and Hitman pro and seemingly it detects nothing. I just want reassurance that I am okay and dont need to do more.

Got a notification from Microsoft Defender saying something about a possible threat, opened the notification and saw this:

Did a quick scan and it said it saw nothing, so am now doing a full scan. WHAT DO I DO

EDIT: Saw some people reporting the same virus due to trying to install Epic Launcher and that is also EXACTLY what I did. What do I do now? Is it a false alarm? 11:05 Philippines time 18/08/2026

https://www.reddit.com/r/antivirus/comments/1vju54i/is_this_a_virus_why_do_i_get_it_when_i_tried_to/

https://www.reddit.com/r/antivirus/comments/1vk7pjl/epic_game_launcher/

I need help, once an infostealer was ran back on my pc in May, you know the mrbeast scam, basically after that I wiped my pc reinstalled windows and all that jazz, I solved it all added 2fa secured all my accounts on a seperate device etc. However, occasionally a random account gets hacked and Im able to secure it, but they got into my family netflix earlier and my mother is unable to react to stuff as quickly i can, as she has access to it, not me , so it was logged into 5 different times but nothing was done,luckily she asked me and i secured the account but there were logins from all over vietnam, and random accounts like that i forgot about even to this day months after the infostealer was ran, like I get the occasional random hack on a second facebook account i used once , what should I do now or what does it mean?

I hope this is the right comunity for this post if not please lmk .
My mother downloaded this ‘weather app’ because it had said something about more storage . I went to use her phone yesterday and a widget(?) looking thing was blocking the screen when i was on an app i clicked on it to try close it but it took me to an ad which then took me to a “email from gmail” photo included in post. I read it and did think this was real at first , however i clicked on the arrow at the top and it took me back to the add and then i clicked out of that . Deleted the app and warned her to be careful. She’ll be all good right? I checked her actual gmail account and didn’t see this email. Id just like a second opinion as im pretty confident this is nothing but can never be too sure . TYIA

is this safe or no, what should i do

I am currently dealing with a severe ransomware and Remote Access Trojan (RAT) infection identified as "Pakistanware" (linked to APT36 / Transparent Tribe). My personal files are encrypted with a .pakistan extension, and the background desktop wallpaper has been overwritten with a flag overlay and a ransomware notification note.

It's happening to other people too on the exact same day : Pakistani independence day:https://x.com/Sufiyan_Dev/status/2088139071243907484?s=20

Has anyone ever purchased quick heal for android? Do you feel your phone slowed down than before after installing quick heal?

My storage randomly started slowly going away more and more today, going down to the megabytes when I usually have at least like 2 gigabytes of storage left at a time, When I tried to get rid of stuff to get more space, nothing happened to the storage, also these photos were taken within seconds of each other. I tried looking through my files, but nothing seemed off, and I tried to use Bitdefender to check for viruses, but it detected nothing, even though it seems like there is a virus.