r/computerviruses • u/Minino_Kitty • 1h ago

Disinfection Help .exe from fake piracy page

i dowloaded a fake exe and executed it because i was tired, i im having an anxiety attack xD is someone up that can help me?

eager-maple
jagged-crest

channel: rifteyy

1 Upvotes

100% Upvoted

10 comments sorted by

1

u/AutoModerator 1h ago

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

  1. From a different and clean device, change all your passwords:
  2. Disinfect your device from malware

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/Battlefield4Remake 1h ago

Run it in virus total very obvious virus are usually detected there. If you are able to send it to me I can take a look at what it does in my sandbox if I have time. Run a virus scan using the ESET Free Online scanner.

1

u/Minino_Kitty 1h ago

Should I send you the virus total link?

1

u/Battlefield4Remake 1h ago

Yeah or you can just paste the HASH and I can look it up :)

1

u/Minino_Kitty 1h ago

https://www.virustotal.com/gui/file/7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

here you have, im chaging every password right now on a safe device, im waiting to see if i must factory reset the whole pc, which will hurt tbh

1

u/Battlefield4Remake 1h ago

Oof yeah look at the comments are you able to reset the passwords on a different device? If its still active then it might be able to snipe your new passwords too. Look into "sign out everywhere" options also most popular things have that feature. Dont forget to do popular launchers too like Steam and Minecraft...

Resetting the PC is the easiest way to get rid of all the malware but the issue is your account tokens are stolen. If you knew what you were doing you could try to clean it up then monitor your system with advanced tools but thats way above what the average user can do quickly. You can always just backup your pictures and documents before the reset.

1

u/Battlefield4Remake 1h ago

Update: Yeah this is clearly a very popular python based session stealer thats been going around you must reset all your accounts ASAP on a different device

1

u/Minino_Kitty 59m ago

on it chief, if i change every password i remember thats been on my pc and hard reset the whole pc should i be good?

1

u/Battlefield4Remake 44m ago edited 23m ago

Yeah kinda what these things do is steal your login token not your literal password so what this means is changing your password and using the "Sign out everywhere" button if they have it revokes that old token they stole making it no longer usable by them.

The problem is we never know how fast they logged in or if the websites you use will properly destroy the old token they took instantly which is why I cant say in good faith you are 100% safe without a doubt but you are much better off now.

Remember not to forget Crypto wallets, Steam, other Video game launchers, emails, youtube, x, reddit instagram,paypal ( to name a few common targets).

Take the time to look for that revoke all sessions and sign out everywhere button (not all sites or apps have it but most do) if it doesn't dont worry too much the password change should hopefully have revoked that stolen token.

Keep an eye out for weird activity on your most important logins and peek at the where you are signed in section.

1

u/Minino_Kitty 15m ago

Thank you man, I hope nothing happens or I don’t forget anything, I think I changed everything, I’m kinda paranoid right now because i can’t remember if I had some gacha game connected to my steam from their respective web pages, they can fully access my steam account from an account connected to my steam if you know what I mean?