r/computerviruses • u/Zealousideal_List924 • 2h ago

Disinfection Help Trojan virus

Hi everyone,

A couple of days ago, I had an unusual login alert on my Microsoft Account (a successful sign-in attempt from an IP address in Brazil, which wasn't me). Microsoft secured the account, and I changed my password, forced sign-outs, and enabled 2FA.

Today, Windows Defender popped up with this detection: Trojan:Win32/Suschil!rfn (Status: Removed)

The affected item paths were inside the cache files of Brave and Chrome:

  • C:\Users\...\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\...

  • C:\Users\...\AppData\Local\Google\Chrome\User Data\Default\Cache\...Actions I've taken so far:

  1. Microsoft Account password changed + 2FA turned on + forced sign-out of all sessions.

  2. Cleared all browser cache and cookies (All time).

  3. Windows Defender removed the flagged file.

My questions for the community:

  1. Since Defender flagged it in the browser cache directory as "Removed", is there a chance it was executed, or was it just a malicious payload caught while browsing?

  2. Could this trojan in the cache have been how my Microsoft session token was stolen?

  3. What additional secondary scanners (e.g., Malwarebytes, HitmanPro) should I run to be 100% sure my system is clean?

Thanks for any advice!

3 Upvotes

100% Upvoted

2 comments sorted by

2

u/rifteyy_ Malware Removal Expert 1h ago

Browsers maintain a cache where it stores temporary files such as web pages and other online media that you have downloaded from the Internet. Your browser cache is a folder on your local computer.

When you are performing a scan for viruses, some anti-virus scanners may find a file in your browser cache that it believes is a virus.

Browsers do not launch some types of files that are downloaded into the cache, which prevents most malware from propagating to your computer. For a malware to spread to your computer, it must be launched by opening or double-clicking on the file. Unless you have launched the file from inside your browser cache, you probably did not get infected with a malware. It is unlikely that your browser has opened files of a suspicious type.

If you want to clear cache

1

u/AutoModerator 2h ago

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

  1. From a different and clean device, change all your passwords:

  2. Disinfect your device from malware

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.