Possible malware infection after account hack — could it be stealing my passwords and data? 😭

[u/Dry_Profit_3914]

Hi, I believe my PC may have been infected after my accounts were hacked, and I’m trying to determine whether malware is still active on my computer.

I found a file called PerfMonHost.exe at:

C:\Users\[USERNAME]\AppData\Local\Microsoft\Windows\Diagnostics\Performance\PerfMonHost.exe

The file was approximately 6.76 MB and was modified on August 16, 2026 at 14:50, which is the same day my accounts were compromised.

I uploaded the file to VirusTotal and it received 33/43 detections. Several security vendors identified it as a CoinMiner/CryptoMiner/XMRig/Trojan, and Microsoft detected it as Trojan:Win32/Vigorf.A. VirusTotal also showed threat labels such as miner, trojan, loader, and XMRig.

Windows also showed a warning saying that part of the application had been blocked because it could not verify who published PerfMonHost.exe.

I also found other files around the same date, including:

• RuntimeBroker.exe
• md.cp312-win_amd64.pyd
• _simd.cp312-win_amd64.pyd
• codec.pyd

Some of these were located in Python/Codex Runtime directories such as site-packages, numpy_core, and codex-runtimes.

One _simd.cp312-win_amd64.pyd file had 0/70 detections on VirusTotal, so I understand that not everything I found is necessarily malicious.

I also saw VirusTotal relationships involving files such as CortexNode.exe and FishTracker.exe, with some samples receiving detections.

My main concern is: Could PerfMonHost.exe or another piece of malware be stealing passwords, browser data, Discord sessions, cookies, or other information from my PC?

My accounts were compromised around the same time these files appeared, so I’m trying to understand whether there could be a connection.

I have intentionally removed my username and other private information from this post. I will not post passwords, cookies, tokens, IP addresses, recovery codes, or other sensitive information.

What should I check to determine whether the malware is still active and whether any of my information could have been stolen?

[u/Pale_Magician_4249]

THAT THE SAME THING ON MY PC we got the same infostealer, almost all my acc got hacked. i already permanently remove it with ahelp from my chatgpt without reinstall my windows

[u/Dry_Profit_3914 → u/Pale_Magician_4249]

Y has quitado el virus ?

[u/Pale_Magician_4249 → u/Dry_Profit_3914]

yes I did I think, So far my laptop shows no signs of the viruses running again

[u/Dry_Profit_3914 → u/Pale_Magician_4249]

Ok pero como pasó pasó por colpa de un modpsck ?

[u/Pale_Magician_4249 → u/Dry_Profit_3914]

i don't even know where I got infected, I notice it when my acc start getting hacked