I was redirected to a fake Cloudflare verification page that instructed me to paste a one-line command into Command Prompt. I ran it, and the command appeared to do nothing for about a minute before I realized it was suspicious. I stopped it and immediately disconnected the laptop from the internet.
Since then, I booted into Safe Mode, ran a malware scan that found nothing, restored Windows to a restore point from three days earlier, and ran Microsoft Defender Offline while still disconnected. I also cleared temporary files. Using my phone, I changed every password that had been saved or autofilled in the browser, secured my primary email accounts, froze my bank cards, and signed out of other devices wherever possible.
The PowerShell event logs suggest that the command downloaded 7-Zip and another encrypted archive, extracted a second archive, and launched an executable. The script used temporary folders, downloaded files with Invoke-WebRequest, and eventually ran a final EXE. I do not know whether the payload successfully stole or transmitted browser passwords, cookies, autofill information, or other data before I disconnected the computer.
What can realistically be determined from these logs? Does the absence of new login alerts or active sessions mean anything, given that stolen browser cookies may allow access without a normal sign-in? Should I completely erase the system and reinstall Windows from a clean USB? Finally, is it safe to copy important photos and documents to another drive first, and how can I avoid transferring malware along with them?
3 Answers
Copy only irreplaceable personal data, such as photos, videos, and ordinary documents, to a separate drive. Avoid transferring executables, scripts, installers, macros, browser profiles, archives, or anything you do not recognize. Disable AutoPlay, do not open the files on the suspected system, and scan the backup from the freshly installed system with updated security software before using it. An external drive reader or a clean Linux environment can reduce the chance of accidentally running something, but it is still important to scan the files afterward.
If the files are extremely valuable, make two backups and keep one disconnected. After reinstalling, change any remaining passwords from the clean system and continue monitoring important accounts.
The PowerShell entries show a multi-stage downloader. It retrieved 7-Zip and a password-protected archive, downloaded another archive, extracted both, and started an executable. That confirms the command was designed to run a payload, but the logs alone cannot prove exactly what the final program did or whether data was successfully uploaded. Event Viewer generally will not give you reliable proof that credentials were or were not stolen.
Treat every browser-stored password, autofill item, session cookie, and potentially accessible file as exposed. Changing passwords from a separate, trusted device was the right response. Keep multi-factor authentication enabled, revoke active sessions and application tokens, review recovery methods and forwarding rules for email, and monitor financial accounts. The lack of unfamiliar login notifications is not proof of safety because stolen cookies can sometimes bypass a normal password login and generate no new-device alert.
A system restore and clearing temporary files are not reliable malware-removal methods. Since an unknown executable was downloaded and launched, the safest option is a full clean installation of Windows. Create the installer using a known-clean computer if possible, erase the system partitions during setup, reinstall Windows, apply all updates, and reinstall applications from their official sources. Do not restore programs or browser profiles from the old installation.
So even though there were no unfamiliar sessions listed, a stolen session cookie could still have been used without appearing as a normal login?