Need help getting rid of an info stealer / session stealer

Hello! So recently, I downloaded a sketchy software thinking it was fine, as after a week or two nothing had happened. Fast forward more than half a month later, I get an email letting me know that one of my accounts was hacked. I've since got it back, but I've been really anxious these past few days wanting to get rid of the info stealer, and would like to get some advice on what else I can do on my pc to get rid of any remnant of the info stealer. So far I've done these things:

• Change all my passwords and enable 2FA where I can (Passwords which I just made up and placed safely so I remember them, so they cannot be past ones. Also have enabled passkeys)
• I've cleared all browser cache (Since I the malware was targeted towards a specific game, and hence only got info from the browser)
• Downloaded Malwarebytes and conducted multiple scans, and windows defender offline scan
• Looked in task scheduler and autorun to find suspicious generic name tasks. I deleted them in the appdata folders

Additionally: After the scans, there were lots of viruses found, and deleted. However, even after the scan saying all clean, there was still a trojan loader that was trying to load something which malwarebytes stopped every day, so the antivirus missed some deep malware. They were in the appdata Microsoft folder with names like "Vault, Defender" and had dll files. However, after looking at the files and deleting more scheduled tasks like "update" and "update browser", I still cannot rest easy knowing it might still be on my computer.

My thoughts so far is that since I downloaded the software for a specific game, it would have stolen the data off my browser. Could it also have stolen other things on my pc? I don't think its ransomware.

I know I can reset my pc, however, I have so many things on my pc that I think I cant back it up, lots of offline things and photos. I do not have an external drive, or online storage.

I would really appreciate some help on how to do the most to get rid of the info stealer without resetting my pc, any good scanners that can help me find the root of the malware? I just want to be very sure. Any help is greatly appreciated. I can send any logs or screenshots needed.

From Google
When a Trojan keeps regenerating in the AppData folder (under names mimicking legitimate tools like "Vault Defender" or "Edge Defender"), it means a persistence mechanism is actively running in memory or a hidden script is re-downloading it every time it's deleted.
Because Malwarebytes can't easily stop this loop while the threat is actively running, you need a precise combo to break the cycle remotely.

Step 1: Kill the Active Malicious Processes (Rkill)
Before running another scan, you must terminate the hidden background processes keeping the Trojan alive.
1. Download Rkill via BleepingComputer. (This is a free tool designed to kill known malware processes without deleting any files).
2. Run rkill.exe.
3. Crucial: Do not reboot the computer after running Rkill, or the Trojan will just start up again. Leave the PC exactly as it is.
Step 2: Remove the Startup Triggers (Autoruns)
Trojans in AppData usually trigger via hidden Registry entries, scheduled tasks, or startup links.
1. Download Autoruns for Windows from Microsoft Sysinternals.
2. Extract the ZIP file, right-click Autoruns64.exe, and select Run as Administrator.
3. In the search/filter bar at the top, type Vault (or whatever specific name was found in AppData).
4. Look through the results under the Everything or Logon tabs. If you see an entry matching that file path in AppData, uncheck the box next to it to disable it, then right-click and select Delete
Step 3: Run an Aggressive Second-Opinion Scan
Since Malwarebytes is hitting a wall with this specific payload, switch to a specialized aggressive engine.
Download the Norton Power Eraser (NPE) or the Kaspersky Virus Removal Tool (KVRT). Both are completely free, portable, and specialize in deeply embedded Trojans.

Step 4: Run a Microsoft Defender Offline Scan

If the Trojan is still stubborn, hand the task over to Windows before it even boots up.
1. Go to Settings > Update & Security > Windows Security > Virus & threat protection.
2. Click on Scan options.
3. Select Microsoft Defender Offline scan and click Scan now.
4. The PC will restart into a secure, pre-boot state and clean out the AppData folder before the Trojan has a chance to execute code.

If you truly desire to declare full scale war on this malware DRASTIC MEASURES are another option:

1) Flash your BIOS.

Flashing the BIOS can void you of any potential root kit that could exist at the pre-boot level. A great opportunity to get the latest BIOS.

2) Reinstall your Operating System.

A fresh Operating System on a brand new hard drive is for all intents and purposes free and clear of viruses and malware. Exceptions would be if one regarded parts of the operating system equal to malware. Things like Co Pilot, One Drive, Bit Locker etc. There are ways of eliminating these as well.

3) A brand new C drive. (See: #2)

4) NEVER use your email password for other applications. << I cannot stress this enough.

5) Change your email address. Stop using the old one.

This may take time so opting for a transition by keeping an older PC as you eliminate apps and programs over time is an option worth considering. I do NOT advise making any financial transactions or using data sensitive apps on this older PC. The ultimate goal will be to purge it of all your old data.

6) Change the password on your router. If you do not know how to do this read the manual that came with your router. If your ISP provided your router they should be able to help you to do this. This is what their technical support is for.

7) Refrain from using new log ins on hardware that you suspect may be infected or compromised. If you use your PC for financial transactions make certain that your financial institutions are aware of your NEW email address.

The above tips are only suggestions on how to play 'hard ball' with a compromised system. Some may disagree BUT I have helped dozens of people get back their security this way and the test of time has proved them to be effective measures. I hope this helps.

Ruiwenation said:

I know I can reset my pc, however, I have so many things on my pc that I think I cant back it up, lots of offline things and photos. I do not have an external drive, or online storage.

Click to expand...

IF you want to be safe resetting your PC really isn't an option. This is your ultimate goal. There are USB sticks with huge capacities for storage these days that will allow you to drag and drop all your pictures and personal files to. If you need more space then an external drive is a wiser choice. You can't pour poison in your bathwater and say, "I want all the poison out and my bathwater to be just the way it was before it got poisoned." NOPE. You have to drain the swamp. If you have prized fish in that bath you have to fish them out and quarantine them. Even resetting your PC is no guarantee that it will be safe but it's a good start.

Sign out of every active session on each account you used in that browser, using the "sign out of all devices" option in the account's security settings. A session cookie the stealer copied keeps working after a password change and 2FA until that session is ended, so do this once the PC is clean.

If Malwarebytes blocks the loader again, turn on task history in Task Scheduler first (Action menu, Enable All Tasks History).

Note the time of the next block in Malwarebytes' Detection History, then open Event Viewer at Applications and Services Logs > Microsoft > Windows > TaskScheduler > Operational and look for event 200 or 201 at that minute. The task name in that event is the one still launching it.

Drafted with AI.

Hello @Ruiwenation and welcome to ElevenForum.

As others have mentioned, a clean install of Win 11 is the only way to be sure.




However, if you absolutely refuse or don't want to do that, then you should head over to BleepingComputer, and let them find, kill, remove, etc., all the nasties you have on your computer. They will assign you a case worker, sort of, who will walk you through the entire cleaning process. It "will" take a few days. But if anyone can clean the computer, they can. ^^







On a side note, once you get everything cleaned up...


Here's some other things that you may find useful...

Thank you all for your wonderful suggestions! I am truly grateful. As for resetting my PC, I would, however i have game progress and other offline things stored on my computer I'm not sure how to export, and I'm also not sure how I can backup my saved progress without backing up the virus, however fortunately, I have only seen the malware attempt to steal one piece of data so far, with no attempt to hijack my other accounts. (Just to be safe though I have assumed they have it and tried to sign out everywhere and change my passwords) And I've decided to take the BleepingComputer route on cleaning my pc as hard as possible.

Ruiwenation said:

Thank you all for your wonderful suggestions! I am truly grateful. As for resetting my PC, I would, however i have game progress and other offline things stored on my computer I'm not sure how to export, and I'm also not sure how I can backup my saved progress without backing up the virus, however fortunately, I have only seen the malware attempt to steal one piece of data so far, with no attempt to hijack my other accounts. (Just to be safe though I have assumed they have it and tried to sign out everywhere and change my passwords) And I've decided to take the BleepingComputer route on cleaning my pc as hard as possible.

Click to expand...

if you are that badly infected you dont want to save anything
a complete wipe and format of everything including all drives

reset your router as well to its defaults
as stated above re-flash your BIOS as well
otherwise it will start all over again.

best of luck Steve ..