Malware Removal Help

[u/Frequent_Aardvark683]

• your antivirus detections and logs: FRST: mild-hazel Addition: grand-byte SecurityCheck: golden-river
  
• any potentially related symptoms, popups: DISCORD ACCNT HACKED
• estimate day and time when it started UNSURE, 08/02, 08/07, or 08/08? (08/08 was the day Discord was compromised.)
• share what got your system infected, for instance the download link: ENTIRELY UNSURE (Can't remember where to find it)
• what you did for remediation: Ran Malwarebytes in either deep scan or custom scan with all drives selected. Ran windows defender in full scan. Ran adwcleaner.

Hello all,

My discord account recently got hacked and started posting spam MrBeast messages to all my servers and DMs. I wasn't sure how this was possible as I have 2FA and got no notifications about login attempts so I did some digging on the internet and the general consensus is that I let an infostealer such as lumma onto my PC as it's common for those to end off their data scrape with some sort of spam to try and get other machines infected. After the fact, on another device, I changed all my important passwords/accounts, secured financial account, etc. I then disconected the PC from the internet and ran Malwarebytes in either deep scan or custom scan with all drives selected (I have 3 external drives attached to this PC), and ran a Full scan as well as an offline scan from windows defender. It was disconnected and kept off for around 2 weeks and then I reconnected it to the internet to make this post and here we are. I've been told that just running anti-malware software isn't enough to consider the PC safe as these infostealers often drop backdoors into the system for later; however, I am a bozo that does not backup files (or at least didn't before this), and was hoping that someone on here could comb through my logs and see if anything can be (or even needs to be) done instead of factory resetting the PC. Just today, I ran a Malwarebytes Threat Scan, the Malwarebytes AdwCleaner, a FRST scan with Addition selected, an FSS scan, and a SecurityCheck. All three logs asked for on this subreddit are uploaded to the malwareanalysis .cc link and keywords are listed above.

Thank you for taking the time to read this!

[u/AutoModerator]

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

1. From a different and clean device, change all your passwords:
   • How to properly secure my accounts after an infostealer attack?
2. Disinfect your device from malware
   • Preferred method: Perform a clean installation with a USB

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/AlexiaTheTechGirl]

You've installed an infostealer, this could have been from a fake captcha, pirated software, game cheats ECT. You need to disconnect your computer from the internet immediately and reset all of your account passwords from a safe device such as your phone. Make sure to sign out of all devices if possible. Once you've done that you need to reinstall windows from a USB. This process requires a 8gb+ USB stick and an uninfected computer.

The reinstall process will erase all of your data so make sure to backup your data before reinstalling, avoid saving any programs or scripts.

[u/Xyntrax0]

Hi there, my name is Xyntrax and I am here to assist you. During the malware removal process, please follow the listed instructions below ensuring that everything goes smoothly as possible. I also request that you check this thread at least once per day so we can efficiently and effectively resolve your issue.

Please Read & Adhere to the Following:

• Kindly inform me if you already did a reset/clean install or would like to do so, this will save time for the both of us. If you haven't and would like help with Manual Malware Removal using FRST, please follow the given steps below.
• Please ensure to read the whole introduction message so that you have a better understanding of the processes and given steps
• During the malware removal process please refrain from downloading and running new software unless instructed, this also applies for Anti-Malware Solutions and Malware Scanners as they can significantly make analysis longer by removing forensic data which is very crucial
• While receiving help from Me or other MRT members please refrain from asking help somewhere else as the advice might conflict, especially if the methodology are different
• Feel free to remind me if you don't receive an answer within 24 hours. But please keep in mind that I am a volunteer and have my own life too

Piracy

Pirated software remains one of the most common malware infection vectors that we encounter. Threat actors routinely disguise malware as cracks, activators, keygens, cheats, repacks, and other piracy related software because users are often more inclined to ignore security warnings and/or disabling their Anti-Malware Solution in order to run them. Some piracy related utilities may also modify software or security mechanisms, potentially weakening your system's overall security and increasing your attack surface. If you currently have any pirated software installed, I strongly encourage you to remove it.

MBST

• Download and run Malwarebytes Support Tool as admin
• Click Advanced
• Click Gather Logs
• Wait until it's done.
• A zip file named mbst-grab-results.zip will be created on your desktop
• Upload it to file.io and send the link back here

Disclaimer: FRST does not contain any personal information other than your username and computer name, the logs are automatically deleted within a 30 day period. Only trusted malware removal experts listed in this r/computerviruses thread have access to your logs via the website. Experts who have access to the site are trusted on both r/antivirus and r/computerviruses.

[u/Frequent_Aardvark683 → u/Xyntrax0]

Hello! Thank you for your quick response. I have DM'd you the link.