I downloaded a RAT. AND IM WORRIED!

Hello everyone who reads this thank you for your time and advice.



Last week I was lured into downloading a link that would improve my QOL at TOA..after downloading the link about 45 seconds later my screen went black I changed password immediately but once I gained access to my account everything was gone 4b gp.



Since then I did a Windows 11 (restore) after reading on the internet that wasn't going to be enough I proceeded to download Windows 11 onto a USB and delete and reinstalled windows 11 completely. When doing so where the partition screen popped up I deleted all then reinstalled windows on my hard drive.



Now after doing this I signed into my windows account and have something called clouddrive and in that I still had some screenshots of some things which I figured would of been deleted. So it has my anxiety on 100. Is my account safe to use now?

Was the reinstalling of windows 11 and deleting the partitions enough?

 

Hi,

Firstly, big RIP to your 4b.

I am assuming you are referring to Windows OneDrive. OneDrive stores your files in the cloud. If you have it synced then once the RAT has been deleted, it should be deleted from OneDrive. It depends on your settings.

If you had it synced, technically the RAT may be in your OneDrive meaning that you may still have the RAT.

Seems like you took the right approach with reinstalling Windows 11.

 

If you wiped your whole drive you should be fine. Make sure you have nothing in the cloud
btw was this u?

 

Careful, I've heard this lurking around. If you return to the game, they'll loot you again when you have a decent amount of gold.

I don't know how to get rid of the RAT, however I'm just telling you this a pre-caution.

 

Restoring windows was the right choice. I would not worry about the items in your one drive, however if you are still worried you can just safely delete them.

Going forward, if you aren't 100% sure about a program, I highly recommend running it in a sandbox environment.
Documentation on how to enable this on windows 11 can be found here;
https://beebom.com/how-enable-windows-sandbox-windows-11/

 

i can recomend:
Changing passwords
check for changes on recovery mail/questions&answers
i usually use malwarebytes to remove/scan my computer but if you dont download wrong things all gonna be safe.

if you gonna download any file and you are not sure use a sandbox or virustotal

 

Honestly if you are not very tech-savvy I'd bring it to a PC store, explain the situation and ask them what will they do other than reinstalling OS (since you did that yourself)

 

This is a horrible suggestion, they are just going to reinstall windows for him and charge him $200. That can easily be done by anyone.

 

You are actually right, but I'd ask what actions they will undertake to provide security, not simply reinstall OS, I'd tell them I already did that but still am worried, what else can be done.

Guess I misworded myself.

 

Reinstalling windows is the only safe thing to do, you can use anti-virus software but it still might not find it.

 

Nowadays even if you reinstall Windows you may still be infected.
It's called a rootkit. Format the hard drive and delete all partitions before reinstalling Windows.

 

How did you get that? You lure?

 

Just get a need HDD/SSD/NVME and couple rams for 101% safety

 

Hi,

This is really sad to hear and I know that this was a big financial loss, even in the real world; I think 4 billion GP equates to a significant amount of USD. It isn't the end of your world, though!

That being said, I would re-install Windows onto a fresh USB on a different device first. The reason for this is because some malware can infect inserted USB's. Further, some malware is persistent in memory, so initiating a fresh install would also be a good option. For the Cloud Drive, I'm assuming you're referring to Microsoft OneDrive. Do not reconnect OneDrive.

Regarding account security, make sure your 2FA is reconfigured, a new password is set, all connected accounts are disconnected, and all active sessions are terminated as well.

I would also invest in desktop protection. My favorite right now is Kaspersky. If a downloaded file passes Kaspersky's initial malware check and you still feel on the edge about it, feel free to run it through Virus Total to get additional scans from open-source intelligence.

My background: Digital Forensics and Cybersecurity