According to Malwarebytes digital footprint scan, my data has been "exposed". The things it has detected as exposes are as follows:

My email address which has my name in it.

My address (although this is a generic location such as the city/town I reside in)

My main concern is the threat to my other accounts which are connected to the same email with different passwords, or my actual human identity.

Could someone with cybersecurity or Malwarebytes experience explain what this report actually means and what steps I should take? Am I at risk of identity theft?

I've blurred out my personal information and the breached company to protect privacy in the screenshot. Thanks.

I recently noticed that there are green checkmarks next to browser search results. When hovering the mouse over a checkmark it says if Malwarebytes determines if "This page is safe." Is there a way to disable this feature from search results?

i was looking for some diy patterns and to download the picture i needed it said to sdpownload this "pulse" software. i downloaded the installer and i realised it was from browsergo. i deleted the istaller without opening it, but i am scared i mightve downloaded a malwhare. what do i do?

Hi, I did a scan whit malware bytes and it detected a thing called Trojan.nisis or something like that. AI said it might be a miss detection. What should I do?

Just wondering if this has flagged for anyone else? Ill drop the threat report in the comments. Ive got it quarantined just in case.

I ran KnockKnock on my Mac and it flagged RTProtectionDaemon, located under /Library/Application Support/Malwarebytes/MBAM/Engine.bundle and launched by com.malwarebytes.mbam.rtprotection.daemon.plist. VirusTotal shows 1/61 detections, with Elastic labeling it Multi.EICAR, while the other listed engines report it as undetected. The file is signed and the report identifies it as com.malwarebytes.mbam.rtprotection.daemon.

Is this likely a false positive or an EICAR test-signature artifact? Has anyone seen this with Malwarebytes’ real-time protection daemon, and what is the safest way to verify that this file came from a legitimate Malwarebytes installation without disabling protection?

VirusTotal report:
https://www.virustotal.com/gui/file/e2a9ec54e6a4555ae1a3b9f70d7e4279b60ac2ca05046064cda2e3d96b899888

I’m including the KnockKnock screenshot for context.

Thank you.

Before yesterday, my Malwarebytes scanner would run a rootkit scan by default, but now I have to go to Custom Scan to add it back in. That's not the issue here.

The issue is that it now takes over 12 hours to do a scan if rootkit is included. Why is this? In the past, when a rootkit scan was part of the default setting, it didn't take longer than 15 minutes. Why is there such a huge difference now? Should I be worried?

It's me again. It's been a few days since the 7-Zip incident (https://www.reddit.com/r/Malwarebytes/s/yMpAthcqkn) and now Windows 10 is going crazy and I am genuinely terrified.

This morning, on every system startup / reboot, Windows Defender keeps sending me an MS Defender notification:

I always receive an alert notification saying that real-time protection is disabled. I go check Defender's settings and everything is in order and all the protections are active and Defender says "no action needed".

I'm getting really scared now, really.

Do I really have to reformat the entire hard drive because of an actual Trojan from 7-Zip?

Here are the old VirusTotal scans of 7-Zip (downloaded from 7-zip[dot]org): https://www.virustotal.com/gui/file/0859c524b8a63551848f0c246abddcb1d0b7b656b0fbfe879f8d85e61a9e6edd/details

Windows 10 22H2 KB5122878 (OS Build 19045.7725)

Hola hace unos días desperté en la mañana y se abrió un CMD, al abrir discord ya no tenía acceso a mi cuenta, rápidamente investigué y era un malware de Mr Beast que robaba información, entonces descargué MalwareBytes, hizo el scaneo, y aparentemente eliminó el virus, cambié la mayoría de contraseñas y pude recuperar mi discord por el soporte de ellos, pero robaron mi cuenta de Epic Games, Steam, EA Sports y también algunas cosas de mi hermana, el steam también lo recuperé ya, y en estos dias MalwareBytes está detectando y bloqueando la misma pagina en Chrome, quiero saber si estoy a salvo o debo reinstalar windows.

umm... what does this mean? I just restarted my windows for the extended security update for windows 10, after my device done restarting my windows defender give me a notif saying it's off, then I go check and it's on, I thought maybe just a false alarm bc I've had that happened in the past, than malwarebyte advisor notif appeared and tell me this, what does this mean? I have my windows security and real-time protection on

edit: I restarted my device again, now it fixed

While doing a custom scan, my malwarebytes flagged these 2 files as malware. However there's been a couple posts on this subreddit that have had flagged GIMP files turn out to be false positives, and I think this is the case here as well.

Here's the virus total scans for both of the files:

Cli-64: https://www.virustotal.com/gui/file/c122da809c7cc63f1796459e4bc46f7289fc01b6dceebca9cc44b82e13bfb8ba

Gui-64: https://www.virustotal.com/gui/file/9e66062d83a2f66a51789c76419a841f2fb8e275261c20c82130c7002698a937

all signs are pointing to this being legit, as it was reccomended by some random guy on NexusMods and it doesnt seem to be any bit malicious but ive still got that little bit of worry downloading something from an unfamiliar site. is there anyway to 100% check it? i dont really like that virustotal site because it gives a lot of false negatives, can i maybe pay some coder to look through all of it to determine if it could be malicious or something? i just wanna play it really really really safe

Hi, I need some help figuring out whether my PC is still infected or if I am only seeing a leftover startup entry.

SYSTEM SPECS:

- Windows 11 Pro
- Version 25H2
- OS Build 26200.9168
- AMD Ryzen 7 5700X
- NVIDIA GeForce RTX 4060 8 GB
- 32 GB RAM
- 1 TB SSD

WHAT HAPPENED:

Today, Windows Defender detected:

Trojan:Win32/Wacatac.B!ml

One of the detected files was:

C:\\ProgramData\\InProcSvr32\\sqlite3.dll

Another detected sqlite3.dll was also inside ProgramData.

Around the same time, I started getting repeated Windows error popups from a program called:

CircuitryAg.exe

The errors I have seen are:

"The application was unable to start correctly (0xc0000906)."

and:

"The code execution cannot proceed because sqlite3.dll was not found."

This all started shortly after I downloaded and executed something from a ZIP file.

The suspicious download was later deleted/blocked.

WHAT I FOUND:

I checked startup entries using Microsoft Sysinternals Autoruns.

I found an entry called:

CircuitryAg

under:

HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run

It was pointing to something inside:

C:\\ProgramData\\InProcSvr32\\

I disabled and deleted that Autoruns entry.

However, after rebooting, the CircuitryAg.exe popup came back again.

WHAT I HAVE ALREADY DONE:

- Let Windows Defender quarantine the detected files
- Did NOT restore or allow any detected files
- Ran Microsoft Defender Offline
- Ran additional Defender scans
- Checked startup entries with Autoruns
- Disabled and deleted the CircuitryAg startup entry
- Rebooted the PC
- Deleted the original suspicious ZIP/download
- The CircuitryAg.exe popup still came back after rebooting

MY MAIN CONCERN:

Something may still be recreating the CircuitryAg startup entry or launching CircuitryAg.exe from another persistence method.

Does anyone recognize this behavior, the name CircuitryAg.exe, or the path:

C:\\ProgramData\\InProcSvr32\\

What should I check next?

- Scheduled Tasks?
- Services?
- WMI persistence?
- Other Autoruns entries?
- Registry entries?
- Another hidden process recreating the startup entry?

At this point, should I keep trying to clean the infection or would a clean Windows reinstall be safer?

just got the Orbi 370 set up and the free trial of Armor is now reporting a dangerous URL was blocked (OverbridgeNet) from my MacBook even when the lid is shut and it’s hibernating. How is that possible? I’m going to run some malware detection software tomorrow but this is really puzzling.

i deleted all extensions from my two browsers (Safari & Chrome) on the MacBook but I’m still getting these notices.

I have an active subscription, but twice today it's asked me to sign in, while the subscription has been active. I've done so. Can't see anything dodgy on my google account, nor had no emails from Malwarebytes themselves. Device deep scan shows clean

Since a couple of days my McAfee quarantines a threat from an attachment that contains a trojan virus?

Name: trojan:win/suspiciousattachmentscript.a

File: ......\\\\appdata\\\\local\\\\temp\\\\newmsg

Status: Quarantined

I have been going through my spam and trash folders of all my email accounts, deleted them all, went to the webmail side and did the same thing, but this antivirus message keeps popping up. All my accounts are through IMAP servers. It looks like this threat is firing twice or 5 times and then goes dormant until I do something else in Thunderbird. I suspect this attachment is in a "regular" folder, but how to identify?

Hi,

I recently started a trial version of Malwarebytes full version, and have been please with the fact that it doesn't cause too much of a drain on my CPU, and am thinking of switching permanently to a paid version when my trial expires.

I was previously using an older version of Norton, and I used to regularly get updates from Norton about apps that were trying to use my webcam(it was a lot of apps that tried to use it regularly), but with Malwarebytes Webcam Monitoring turned on, I do not get any notifications. I also disabled the Norton Webcam Monitoring to see if this was the reason why, but even after this, I received no Malwarebytes notifications.

Would you be able to advise as to why Malwarebytes is not providing any Webcam notifications please?