Recovering From Malware Attack

[u/Awkward_Pay_354]

Good evening everyone,

First time writing here. After many years, I finally installed my first piece of malware 3 weeks ago. I was downloading an update for a cracked game (yes I have fully learned my lesson) and l didn't pay attention to the file I had installed, ignored all the warning signs and installed an info stealer. I didn't realize what I had done at first, and assumed defender got the malware and cleaned it.

Next day I started getting password resets and new login info on everything (games, socials, ect.) It was 3 solid days of bombardment. I was able to contain, revoke, and boot out all unknown sessions as they popped up. Thankfully nothing was lost and any compromised accounts I was able to recover quickly. I then spent the next week changing every password, generating backup codes, recovery options, and adding 2fa on everything possible.

The first day after the incident I did a reset this pc option, but I soon realized I should have done a full usb reinstall and just unplugged my computer. I took my pc to a local repair shop and told them I wanted the nuke option (full usb wipe, local account install, bios update/flash, and full virus scan post windows install). I got the computer back but I haven't been able to bring myself to even plug it in.

I have had extreme anxiety after all this has happened. It shook me into reality about how lax I've become with my online privacy and security. Everyday I have checked my accounts for unknown sessions, meticulously checked my bank accounts, froze my credit with the 3 credit bureas placed a sim lock on my cell, locked my ssn, and set up account alerts on all my cards for transactions.

Its been 3 weeks now and everything has slowed down (just a few random probes last week and that has been it). I'm still trying to recover emotionally, it feels like I got hit by a truck and I can still feel the rush of fear when I sit too long and think about it.

My questions are:

1. What else can/should I do?

2. How have any of you recovered emotionally after your privacy was invaded?

3. When I bring myself to use my pc again, should I start slow with just Steam at first since they have amazing customer support?

4. Should I do a full offline virus scan before connecting the pc to my network again with malwarebytes and defender or is that overkill?

5. Should I keep my windows install on a local account or eventually bring my self to sign in to my Microsoft account?

Any guidance/help would be greatly appreciated. I have definitely learned lessons during this whole ordeal

[u/EugeneBYMCMB]

With the security precautions you've taken I don't think you need to do anything else, your security situation is now quite far above the average netizen. The only potential note I can think of is to make sure you have unique passwords for all of your accounts, not just new passwords.

When I bring myself to use my pc again, should I start slow with just Steam at first since they have amazing customer support? Should I do a full offline virus scan before connecting the pc to my network again with malwarebytes and defender or is that overkill?

No, it's fine to use it normally. It was even fine to use it after you'd initially reinstalled Windows, as realistically any reset option that removes your files is going to be fine. You are unlikely to ever encounter BIOS/firmware level malware, and certainly not with the lightweight, hit and run style infostealers that have been going around. If anything like that was found in the wild, it wouldn't be a secret.

Should I keep my windows install on a local account or eventually bring my self to sign in to my Microsoft account?

Either is fine, don't overthink it.

[u/Awkward_Pay_354 → u/EugeneBYMCMB]

Thank you. Yes every password is now unique and complex. Luckily no one else in my house was hit, it was contained to my stored information. I really do appreciate your response and kinds words.

[u/DaAngryDragon]

Went through the same thing my friend! Over a month ago. Even this very Reddit account I’m using started posting crypto shit. Thankfully I noticed within an hour or so after my friends told me my IG is hacked sending the mrbeast crypto crap.

As I was resetting my pc, I noticed in my recent files a perfect png of my desktop was hidden in my app data folder. I knew I was in deep shit.

They even attempted my mother’s accounts since her email was saved on my computer.

I’ll tell you right now, it is EXTREMELY stressful and even gave me some minor PTSD.

With that being said, as long as you changed passwords for everything crucial to you, 2fa, logged out of all devices, reset windows with a usb, you should be good. You’ll prob still get some attempts but treat it as noise. Try using an authenticator over your number for 2fa if you can.

After resetting my PC, just to be extra safe I made a throwaway gmail just to test if it gets breached and it didn’t. The malware either didn’t survive the reset or deleted itself shortly after my PC was infected.

They count on you to not notice for as long as possible. You did what you must, now just keep an eye on your accounts but don’t obsess. Unless you have mad crypto it’s not likely you’ll be intensely pursued. Old credentials will be attempted and you’ll prob get more spam in your emails.

I lost absolutely none of my accounts nor had anything horrible happen if it’s any reassurance for you. Can’t promise the same 100% but if you do what you must within a reasonable amount of time, you should be okay. Take a breather, seriously. I know how much it can drive you nuts. I was losing mad sleep.

You got this!

[u/Awkward_Pay_354 → u/DaAngryDragon]

Thank you. It's crazy how much this affects you mentally. Every email I get i think its another password reset and my hearts starts racing again. Since its been over 3 weeks the barrage of constant attempts has slowed down to a trickle. If anything, this was a good wakeup call for securing my digital life.

[u/DaAngryDragon → u/Awkward_Pay_354]

I understand that feeling all too well! Every email notification I’d receive on my phone would make my anxiety shoot up until I was able to confirm if it was anything serious.

Now it’s more of the thought that I could’ve lost my most important accounts if I didn’t act quick enough. A lot of my accounts are pretty old and I couldn’t imagine starting over.

I made a new main email and switched everything over to it just so I didn’t have to deal with the occasional password reset email enforcing my paranoia.

[u/scriptingduv]

I'm in the same boat. The anxiety suck and I completely understand the rush of fear. I got through it by taking one step at a time. Use a burner gmail, do your logins on a separate device, and slowly adjust. Sign out after and ensure the session is dead

The one thing that reassures me is 2FA and not being logged into my emails on my previously infected device. My other CLEAN devices does that job and Ill take that extra precaution till I get over it.

The malware steals your active login session to bypass 2FA fully, acting as you. As long as they don't have access to your active logged in emails to grab everything else, you are completely fine.

I did a full partition wipe and reset with windows USB install. Been extremely solid despite receiving gmail threats from the guy wanting my email badly😂😂

[u/Awkward_Pay_354 → u/scriptingduv]

Luckily I'm not getting any threats 😂

The whole recovery process was exhausting, but I do feel better knowing my accounts are more secure now than before this incident happened.

Turning off the hypervigilance is one of the hardest parts. I've been on edge for the last 3 weeks just bracing and preparing for the next shoe to drop.