I installed a game from an unfamiliar website, and afterward a new drive appeared in File Explorer. I deleted it, but the next day I received password-change notifications for several accounts, including Steam, Epic Games, Discord, Battle.net, and Microsoft. I disconnected the computer from the internet and recovered most of the accounts, but my Battle.net account was fully unlinked. I'm worried that malware or a credential stealer is still on the PC. Memory integrity is currently disabled and Windows won't let me turn it on. What should I do next to secure my accounts and make sure the computer is safe?
2 Answers
The safest option is a clean Windows reinstall, not just deleting the suspicious drive or running a normal scan. Back up only personal documents, photos, and other files you know are safe; don’t preserve installed programs, scripts, cracks, or unknown executables. Create Windows installation media on a trusted computer, delete the existing system partitions during setup, install fresh, fully update Windows and drivers, and then reinstall applications only from official sources. Memory integrity is a security feature, but enabling it now won’t remove an existing infostealer and may be blocked by incompatible drivers.
Treat the computer as compromised. Don’t use it to log in, change passwords, or access financial accounts. From a different, trusted device, change your email password first, then change the passwords for every affected account to unique ones, revoke active sessions, remove unknown recovery methods, and enable an authenticator app or security key where possible. Contact Battle.net support through its official account-recovery process and keep records of the unauthorized changes.
Before restoring anything, scan the backup files and avoid copying browser profiles, saved passwords, or app data. Also check the email account for forwarding rules and unfamiliar recovery addresses, since attackers often use those to regain access.