I was redirected to a fake Cloudflare verification page that instructed me to paste a one-line command into Command Prompt. I ran it, and after about a minute I realized what had happened, stopped the process, and disconnected the laptop from the internet.
Since then, I booted into Safe Mode, ran a malware scan with no detections, restored Windows to a restore point from three days earlier, and ran Windows Defender Offline while the computer was still disconnected. That scan also found nothing. I cleared the temporary files folder as well.
Using a different device, I changed the passwords for every service that had saved browser autofill data, secured my primary email accounts, froze my bank cards, and signed out of all devices wherever possible.
The PowerShell logs suggest the command downloaded 7-Zip and another encrypted archive, extracted multiple stages into temporary folders, and launched an executable. The relevant script appears to have downloaded files, unpacked an outer archive using a password, read another password from a text file, unpacked an inner archive, and started the first executable it found.
I would like to understand what may have happened and what I should do next:
- Is there any reliable way to determine whether passwords, autofill information, browser cookies, or session tokens were successfully collected and sent to a server before I disconnected the computer?
- Does seeing no unfamiliar sign-ins or active sessions on services such as email and social media mean anything? Could stolen session cookies be used without generating a new-device notification?
- Should I completely erase the system and reinstall Windows from trusted installation media, even though several scans and a system restore found no threats?
- I have important photos and documents to preserve. How can I safely copy them to external storage without carrying the malware over?
I am looking for practical steps to recover safely and secure any accounts or data that may still be at risk.
4 Answers
Your personal photos and ordinary documents can usually be preserved, but copy only the specific files you need. Avoid transferring executables, scripts, installers, archives, browser profiles, or files with extensions such as .exe, .scr, .bat, .cmd, .ps1, .vbs, .js, .msi, .zip, and .7z. Ideally, connect the storage through a separate reader or copy the files from a clean live Linux environment, then scan the backup with multiple reputable scanners before opening it on the rebuilt system. Do not make the backup drive bootable or run anything from it.
The script log confirms that the command downloaded an archive utility, retrieved encrypted payloads, extracted them into temporary directories, and launched an executable. That proves an unknown program was run, but the log alone cannot prove exactly what the executable did or whether information was transmitted successfully. It also cannot prove that nothing was stolen. Treat the laptop as compromised rather than relying on scans, restore points, or Event Viewer. Those tools can miss malware, and a restore point is not a reliable security rollback.
So there is no dependable way to reconstruct everything from these logs alone, even if I review the PowerShell events in detail?
The safest next step is a clean installation of Windows. Create the installer from a known-good computer, use a newly created or properly wiped USB drive, delete the existing system partitions during setup, and install all updates before restoring anything. Change important passwords from a separate trusted device, starting with email, financial accounts, password managers, and accounts that can reset other passwords. Enable multifactor authentication where available and revoke existing sessions, passkeys, app passwords, and other trusted-device tokens.
A fresh installation is more trustworthy than trying to prove the old installation is clean, especially after an unknown executable was launched with access to the user profile.
No unfamiliar login alert is not proof that accounts were safe. Malware can steal saved passwords, cookies, autofill data, and session tokens, and a stolen active session may be reused without creating a normal new-device notification. Signing out everywhere and changing passwords was the right response, but also review account recovery addresses, phone numbers, MFA devices, forwarding rules, connected applications, API keys, and recent security activity. Keep the affected computer offline until you have backed up only safe data and completed the clean reinstall.
The important distinction is that photos and documents are generally data, while compressed files and scripts can contain or launch malware. Keep the backup limited to irreplaceable user files and scan it before use.