I fell for a fake verification prompt that told me to press Win+R, paste a command, and press Enter. I ran a PowerShell command that downloaded and executed code from a remote website. Windows Security then reported and quarantined Trojan:Script/Wacatac.H!ml, Behavior:Win32/SuspLumma.H, and Behavior:Win32/SuspClickFix.F. A full Windows Security scan and Malwarebytes scan are now clean. Does that mean my information was safe, or should I assume passwords and browser sessions may have been stolen? I have already disconnected the computer, am changing passwords, and have access to Windows installation media created on another computer. I am considering a complete reinstall.
4 Answers
To reinstall from a Windows USB, leave the affected computer disconnected from the internet, insert the USB, and boot from it using the machine's boot-menu key—often F12, F11, Esc, or a manufacturer-specific key. Choose a custom installation, remove the old Windows partitions on the correct drive, and install into the resulting unallocated space. This deletes the old system. The built-in reset option can also work if you choose to remove everything, but installation from freshly created media is generally preferred when malware is suspected. Back up only personal files you trust, and scan them before copying them back.
Reset this PC is simpler, but a USB clean install gives you more control over deleting the existing partitions and uses installation files prepared on a separate machine. For a suspected infostealer, that extra certainty is worthwhile.
These fake verification pages are commonly called click-fix attacks: they trick people into running a command themselves. On a personal computer where the user has administrator access, the command may have had more ability to install or change things than it would on a restricted work account. Disconnecting was correct, but it does not replace changing credentials and wiping the machine.
A clean scan is reassuring, but it cannot prove that nothing was accessed before the threats were quarantined. The command downloaded and ran remote PowerShell code, and the Lumma-related detection is associated with stealing passwords, browser cookies, session tokens, and other saved information. Treat accounts used on that computer as potentially exposed. From a known-clean device, change your email, password manager, financial, and other important passwords; sign out every other session, check recovery settings and email-forwarding rules, and enable MFA. Do not sign back into those accounts from the affected computer. The safest approach is a clean Windows installation that deletes the existing system partitions. Restore only personal documents—not old programs, scripts, or browser profiles.
Can you explain in simple terms what PowerShell and Lumma are, and what risk remains if I leave the computer disconnected?
PowerShell is Windows' built-in command-line scripting tool. In this case it was used to retrieve and run code from the internet. Lumma is an information-stealing malware family, so disconnecting prevents further communication but cannot undo anything that may already have been copied.
The detections being blocked and quarantined is the best outcome, and it may mean the payload never fully ran. However, there is no reliable way to prove that from a normal clean scan. Change all potentially exposed passwords anyway and invalidate active sessions. A full wipe and reinstall is more trustworthy than relying only on repeated scans.
Is information theft still likely if Windows Security says it blocked and quarantined the files?
It may not have stolen anything, but the alert alone cannot establish that. Assume exposure for important accounts; changing passwords and revoking sessions is much safer than trying to estimate the odds.
What is the difference between installing from a USB and using Reset this PC?