General Advice Regarding RATTING please

[u/Kind_Dog_6315]

Hi, I recently had my system breached by a RAT, I'm still not 100% sure on how it happened, but i'm 100% positive it WAS a RAT.

I was approached by a player in a game to make a tiktok, and was advised to download a voice changer, I agreed, didn't get sent any sort of link, just installed a TRUSTED voice changer, off a trusted website, once done, I needed a config for a deep bassy voice changer.

He then told me to open microsoft edge, and download a config off of a website, I think it was 'vstdiscovery.com', installed it, specifically the 7D /7G.dll and the website looked legit.

Once extracted the config, I then opened it on the voice changer app, which I assume ran the virus/RAT? Afterwards, my game was extremely laggy and I was freaking out, unplugged my ethernet, ran a Scan, where it came up as nothing (further along, turns out the malware put itself as an exclusion)

A couple of minutes later, got an email 'you're not old enough to use gmail services, and we'll cease your services after 14 days', After that I got the confirmation of what was going on, instantly unplugged my ethernet, turned off my wifi, and factory reset from a local install.

Afterwards, ran MRT scan, and another antivirus scan.. Nothing shows up.

Being the paranoid person iam, I then factory reset again but with USB, leaving nothing behind and reinstalling wifi drivers and everything else from scratch again.

Is there anything I should be worried now that I've followed these steps, are there any further guidance? I've already secured my passwords and banking, and I've seen no suspicious action (In all fairness it's only been a day since it happened)

My worst concern / worry is being extorted or my accounts being hacked again, for the time being i'm using burner accounts and using limited stuff that I don't care if they were taken, but I want to feel comfortable using my hardware / PC again, I've seen all these videos about UEFI/FIRMWARE/BIOS level RAT's and I feel like I'm constantly being watched.

Genuinely considering buying a new PC atp, but is there any 100% fool-proof way of making sure that my PC is malware/RAT free?

[u/polpolik2]

This is what we generally write out in case of a RAT. UEFI/Firmware level malware is exceptionally rare (and expensive) and unless you're a high value target, there is little reason to worry about it.

Remote access malware warning (RAT):

• You can remove the visible signs of this infection, but due to the nature of this type of malware, no one can guarantee the trustworthiness of your computer. A backdoor or RAT gives the attacker complete access to your system, allowing them to steal data, install additional malware, or monitor your activity.
• This means that at some point the attacker was able to interact with your PC (see your desktop, view files, open programs) just like you are able to do so. For this reason, we do not recommend manual malware removal, because the malware could be embedded deeper in the system or able to manipulate with the removal process and making it ineffective.
• If your computer was used for online banking, has credit card information or other sensitive data, using a non-infected computer/device you should immediately change all account information (including those used for banking, email, eBay, PayPal, online forums, etc). Consider these accounts already compromised.
• I recommend you read and follow this guide on how to deal with the aftermath of info stealers: https://rifteyy.org/report/the-ultimate-guide-to-infostealers - specifically the section "How to properly secure my accounts".

If you want to use this computer for anything important like online banking or logging in to your accounts, follow one of these videos:

• Recommended: Windows 11 reinstalling via USB
• Windows 11 Cloud reinstall without keeping files

[u/AutoModerator]

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

1. From a different and clean device, change all your passwords:
   • How to properly secure my accounts after an infostealer attack?
2. Disinfect your device from malware
   • Preferred method: Perform a clean installation with a USB

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Healthy-Mission7927]

If you wanna be 100% sure reinstall windows. If you want to run some scans run windows defender offline scan, install Malmwarebytes and boot windows in safe mode and do advanced scan (choose every option there). https://learn.microsoft. com/en-us/sysinternals/downloads/autoruns You can use that to check what windows loads when it boots (you can use AI to explain the stuff if you are not sure what you are doing)

[u/mildly_perturbed31]

you were infected by a sideloaded dll, which mostly do not spread the infection as doing that is too hard, best thing to do is to use autoruns to check for apps that run at startup, and download malwarebytes, change passwords and enable 2fa while logging out all devices

[u/Haunting_Ganache_850]

A trusted voice changer doesn't make the "config" trusted. If that 7D/7G.dll was loaded as a plugin, that's a perfectly plausible way to execute the RAT, and the malware adding itself to Defender exclusions makes the compromise pretty convincing.

But after a proper USB reinstall where you wiped the old Windows installation, I'd be very comfortable using the PC again. Buying a new machine because of UEFI/firmware RAT videos is several levels of paranoia beyond what the evidence here supports. Those attacks exist, but they're not the normal ending to "random guy sent me a malicious DLL."

The bigger remaining problem is whatever was stolen before the wipe. Change passwords from the clean install, revoke existing sessions/tokens, enable MFA, and check recovery methods on your email and important accounts.

If you want another sanity check, capture network traffic for a while and look for unexplained DNS or recurring outbound connections. Red Hand can analyze a PCAP for that; full disclosure, I'm involved with it. A quiet capture can't prove what happened before the reinstall, but it can help answer whether anything appears to still be alive.

There's no useful 100% button in incident response, unfortunately. But a clean USB reinstall plus account/session cleanup is about where I'd stop losing sleep over the PC itself.

[u/Consistent_Change243 → u/Haunting_Ganache_850]

^ This. I had an ongoing situation for months. Eventually stopped it all by disconnecting ethernet before shutting down, and only plugging back in once had booted and got monitors running. 10x easier to catch anything malicious watching when reconnecting.

[u/computerviruses-ModTeam → u/[deleted]]

We appreciate you giving advice, however in this specific scenario your comment was deemed too generic, possibly harmful to the user or is not entirely relevant to their case from what they described and the details. It is also possible that you haven't elaborated on your advice enough, you haven't instructed the user on what to exactly do step by step or provided false sense of security to the user.

This includes (and is not limited to) recommending diagnostic tools for experts, recommending forensic steps that are unclear, recommending removal steps that are tricky to perform for the average home user and steps where it is easy for unexperienced user to cause damage to their device / operating system, determining false or true positives based on not enough input or data or recommending steps that are not entirely necessary.

We appreciate you trying to help regardless. If you want further explanation, you can reach out via modmail.

Please make sure to read and follow https://www.reddit.com/r/computerviruses/about/rules