Remove Infostealer Malware & Secure Your Accounts

Infostealer malware silently steals saved passwords, cookies, and crypto wallets from your PC, then sends them to attackers. This guide walks you through removing the malware, resetting every compromised account, and locking down your system so it doesn’t happen again. You’ll need a second, clean device (like a phone or another computer) to change passwords and verify your identity.

What You’ll Need

• A second device (phone or another PC) that you trust and know is clean.
• Your primary email address and phone number for account recovery.
• A USB flash drive (at least 8GB) if you need to create a rescue disk.
• Access to a reliable internet connection.
• Patience – this process takes 2-4 hours if done thoroughly.

Step-by-Step

1. Disconnect from the internet immediately. Unplug the Ethernet cable or turn off Wi-Fi. This stops the malware from sending more stolen data and prevents remote control.

2. Boot into Windows Safe Mode with Networking. Restart your PC, and as it boots, press F8 (or Shift + Restart from the login screen) to open Advanced Startup. Choose Safe Mode with Networking. This loads only essential drivers and often prevents the malware from auto-starting.

3. Open Task Manager and kill suspicious processes. Press Ctrl+Shift+Esc, go to the Processes tab, and look for anything with a random name (e.g., “xcvb.exe”) or high CPU usage that you don’t recognize. Right-click and select End Task. Note the file location if possible.

4. Uninstall unknown programs. Go to Settings > Apps > Installed apps. Sort by installation date and look for anything installed around the time you suspect infection. Uninstall anything you didn’t install. If unsure, search the name online from your phone.

5. Run a full offline scan with Windows Defender. Open Windows Security > Virus & threat protection > Scan options and select Microsoft Defender Offline scan. This restarts your PC and scans before Windows fully loads, catching deeply embedded malware. Let it finish – it can take an hour.

6. Use a second opinion scanner. Download Malwarebytes (free version) from your phone and transfer it via USB, or download directly if you’re in Safe Mode with Networking. Run a full scan and quarantine everything it finds. Also run AdwCleaner for PUPs (potentially unwanted programs).

7. Check browser extensions and shortcuts. Open each browser (Chrome, Edge, Firefox) and remove any extensions you didn’t install. Also check your desktop shortcuts – right-click and look at “Target” – if it points to a weird .exe, delete the shortcut and recreate it.

8. Review startup programs. Press Ctrl+Shift+Esc > Startup tab. Disable anything that isn’t from a known publisher (like Microsoft, Google, or your hardware manufacturer). If you see a suspicious entry, search its name online.

9. Change your Windows password and PIN. After the scans are clean, go to Settings > Accounts > Sign-in options and change your password and PIN. Also create a new local administrator account, use it for a day, then delete the old one – this ensures no hidden user accounts remain.

10. Reset all stolen credentials – this is the most critical step. Use your clean device to change passwords for every account you use: email, banking, social media, shopping, work, and especially anything you’ve saved in your browser. Start with your primary email, because it’s used to reset others. For each account:

    • Change the password to a long, unique one (use a password manager).
    • Enable two-factor authentication (2FA) – preferably an authenticator app, not SMS if possible.
    • Revoke any sessions/devices you don’t recognize in the security settings.

11. Clear saved passwords and cookies. In each browser, go to Settings > Privacy > Clear browsing data, and select “Passwords and other sign-in data” and “Cookies and other site data”. This removes any stolen autofill data and forces you to log in fresh.

12. Check for crypto wallet theft. If you use crypto wallets, check your balances immediately. If anything is gone, report it to the exchange (they may freeze the account). Move any remaining funds to a new wallet with a fresh seed phrase.

13. Turn on Windows security features. Go to Windows Security > Device security and ensure Core Isolation (Memory Integrity) is on. Also enable Controlled folder access under Ransomware protection to block unauthorized changes.

14. Update everything. Run Windows Update, update your browser, and update any software you keep. Outdated software is a common entry point for malware.

15. Monitor your accounts for a few weeks. Watch for strange emails, password reset requests, or login alerts. If you see anything, change that password again immediately.

Common Mistakes

• Changing passwords before removing the malware. If the malware is still active, it will just steal the new passwords. Always clean first, then reset.
• Skipping the offline scan. Some infostealers hide in system files and survive normal scans. The offline scan is essential.
• Only changing the email password. Attackers often have access to many accounts. You must change every password, especially those with financial or personal data.
• Reusing old passwords. If you reuse a password across sites, an attacker can try it on your other accounts. Use unique passwords everywhere.
• Ignoring the “sessions” list. Even after changing your password, an attacker’s active session may remain. Always log out of all devices.

Tips

• Use a password manager (like Bitwarden or KeePass) to generate and store strong, unique passwords. It also helps you see which accounts you have.
• Enable 2FA on every account that supports it. An authenticator app (like Google Authenticator or Authy) is better than SMS, but SMS is still better than nothing.
• Turn on “sign-in alerts” in your email and banking apps so you get notified of new logins.
• Consider using a dedicated, clean device for banking or crypto transactions.
• Back up your important files regularly to an external drive or cloud service. If malware strikes again, you can wipe and restore.

Troubleshooting

• Malware keeps coming back after a scan. This often means it’s hiding in system restore points or a secondary drive. Delete all restore points (System Protection > Configure > Delete) and scan any external drives. If it persists, do a full Windows reset (Settings > Update & Security > Recovery > Reset this PC) – choose “Remove everything”.
• Safe Mode won’t start. If F8 doesn’t work, try Shift+Restart from the login screen, or use a Windows installation USB to boot to Command Prompt and run sfc /scannow and bootrec /rebuildbcd.
• You can’t log into an account because the password was changed. Use the “Forgot password” link on the login page. If you don’t have access to the recovery email, contact the service’s support – they can verify your identity with ID.
• You suspect the malware is on your phone too. If you used the same browser or apps on your phone, run a scan with a mobile security app (like Malwarebytes for Android) and change passwords from a different device.
• Windows Defender offline scan won’t run. Create a rescue USB with another antivirus (like Kaspersky Rescue Disk) using a clean PC, then boot from it and scan.

Frequently Asked Questions

Q: How did I get infostealer malware?
Usually through phishing emails, fake downloads (cracked software, game cheats), or malicious ads. It can also come from a compromised website.

Q: Do I need to reinstall Windows?
Not always, but if you can’t get rid of the malware or if it’s a sophisticated rootkit, a clean install is the safest option. Back up your files first, but scan them with antivirus before restoring.

Q: My passwords were saved in the browser – are they all compromised?
Yes, assume they are. Change every password that was saved, especially for email, banking, and social media.

Q: Can infostealer malware steal my 2FA codes?
It can steal cookies and session tokens, which bypass 2FA. That’s why you must log out of all sessions after changing passwords.

Q: What if I don’t have a second device to change passwords?
You can use a friend’s device or a public computer (in a library) – just make sure to log out and clear history afterward. Avoid using the infected PC until it’s clean.

Q: How often should I check for malware after this?
Run a full scan weekly for the first month, then monthly. Also watch for unusual account activity.

Related

• How to Clean Up Your Computer to Make It Faster
• Safe to Delete Registry Keys? What to Know
• Fix Audio Service Requires Reboot on Windows 10