Hello,

Yandex, which is Russia's equivalent to companies like Google, had several of its data centers taken offline:

• https://arstechnica.com/gadgets/2026/10/ukraines-drones-knock-out-ai-data-center-belonging-to-russias-google/
• https://www.bbc.com/news/articles/cw0k0g57mk3zo
• https://www.reuters.com/world/europe/russias-yandex-says-data-centre-vladimir-area-shut-down-after-drone-attack-2026-10-11/
• https://www.theverge.com/tech/1009443/yandex-russian-bots-cloudflare
• https://www.yahoo.com/news/world/articles/russias-yandex-bot-traffic-nearly-132951559.html

As a result of this, the online presences for many Russian businesses are either down or operating in a degraded fashion.

It could be that this is affecting your ability to access the MyKaspersky portal.

I would suggest reaching out directly to the company and asking for assistance in cancelling the subscription: https://forum.kaspersky.com/

Regards,

Aryeh Goretsky

Hello,

I'm not familiar with the internals of how Web Guard works, but there may be some settings you can make either to Avast or to your computer to improve its performance.

Generally speaking, any antivirus program's network security features are going to be affected by a variety of factors, such as the speed of the network connection, whether or not you are using a VPN or a network proxy, other bandwidth-intensive programs running in the background (streaming audio or video, P2P file sharing apps for torrenting, and so forth). Even things like the amount of free disk space and memory can make a difference in how well it performs.

What I would suggest is reaching out to Avast's technical support directly at https://forum.avast.com/ and see if they can help you troubleshoot your system and see if there are any steps which can be taken to improve the performance of Web Guard.

Regards,

Aryeh Goretsky

Avast slows down web browsing because of "Web Guard".

Hi Avast, I'm using the free version of the antivirus. I've had this problem for a long time and tried everything to fix it, even calling my internet provider to check it. After many checks, I discovered that this antivirus is causing my web browsing to slow down. Avast should reconsider this. A tutorial for new users would be great. As a regular user, this antivirus significantly slows things down, and that significant slowdown makes Avast less appealing to me. I hope Avast will develop and improve it.

Hello,

The r/antivirus subreddit is neither the VirusTotal nor the Reddit police. What we are is a place where people come for assistance with computer virus and malicious software issues, learn how to better protect and defend themselves against these, and discuss related topics.

While the moderation team here does review messages in the subreddit and those sent to us, we do not have any ability to affect anything outside of this subreddit. Those types of actions have to be taken by the moderators of those other subreddits, or by Reddit's employees themselves (aka the admins).

The VirusTotal link you shared is to a copy of the Discord installation program which is digitally-signed by Discord, Inc. I would doubt that it has been tampered with, but if you think it has, you would want to reach out to Discord directly to ask them about it.

Regards,

Aryeh Goretsky

Hello,

I'll take a look for the message in a moment.

Keep in mind, though, that with all the various security issues the past week, it is likely Reddit is patching their servers in stages, so there may be odd behaviors in various subreddits as these roll out.

Regards,

Aryeh Goretsky

Hello,

I was looking through the list of game stores and the gaming tables they run at https://old.reddit.com/r/ColoradoSprings/wiki/index#wiki_games_and_gaming, but didn't see anything listed for the Cyberpunk TTRPG.

That said, the stores are always updating what games they regularly host in response to what's new/what's popular every few weeks, and it is hard to keep everyone's wiki entry updated. On top of that, there are often random tables where people are just trying out a game system for the night, not a weekly scheduled thing, so it you look around at the game stores' websites and Discord servers you might stumble into a game one night.

Even if you don't see anything listed, it might be worth giving stores a call or leaving a message: it could be that they have been wanting to host a Cyberpunk game, but were worried there were not enough demand for it. Reaching out like that is a great way to let them know there are interested players out there.

Regards,

Aryeh Goretsky

Hello,

Yes, you don't want those things falling into the wrong hands. I had the opportunity to get a tour of Polytechnique Montréal's malware research lab many years ago, and they employed similar techniques to prevent the egress of research materials from the building: You had to leave things like cell phones, laptops, and USB drives outside before entering; no windows or HVAC ducts that could be entered by a person; physical access controls on the doors, etc.

What really brought the security home, though, was that they had gotten waivers from the university and local government on how the fire doors worked to prevent ingress.

Cell phone security is considered even more strict than malware handling these days, so those types of controls which seemed exotic back then are just the baseline now.

On the protocol analyzer side, well, as was pointed out earlier, those aren't inherently for violating people's privacy and their devices' security. They are for developing new hardware, testing for compatibility, etc. While there are probably some control placed on them, it would be more along the lines of what's done with any other expensive lab equipment that's light enough to be carried by one person out the door.

Regards,

Aryeh Goretsky

Hello,

Are you talking about phone calls, texts, or postal mailings?

I don't answer the phone if I don't recognize the number or if the Caller ID doesn't show up, so haven't received any of these. As best as I can tell, none of them have left voicemail, either.

I have gotten an inordinate amount of various large postcards from various candidates or on various issues. I make a point of not looking at them at all but instead throwing them into the garbage can. I do a quick check just to make sure they are all election-related, but most of my non-junk mail comes in envelopes.

I do not respond to SMS (text messages), but I do screenshot them and report the phone numbers and any URLs in them to my security software provider as spam. I also block the numbers.

It is not much, but I feel I'm doing my part by not engaging/interacting with these at all, and trying to stick to sources like Ballotpedia, CPR, NOW's voter guide and the secretary of state's website for information on the elections.

Regards,

Aryeh Goretsky

Hello,

I'm hoping, too. It really sucks to have elected representatives of the people who do nothing to represent the people who elected them.

Regards,

Aryeh Goretsky

Hello,

I have not met the man--probably due to his lack of holding town halls.

When I did reach out to him on a couple of issues, I got form letters back. Very disappointing.

My mother, who lives out of state, had to reach out to her congressman for help with an issue several years ago, and actually did get help from his office, so I know that they actually do this. Or, at least are supposed to.

Regards,

Aryeh Goretsky

Hello,

I already sent in my ballot a while back, and am hopeful things will get better as a result.

It is sad that our own congressman wouldn't help a veteran who had been SA'd. Hopefully the next one will do their job.

Regards,

Aryeh Goretsky

Hello,

Nope, just someone with a lot of experience with Lenovo's computers over the years, who is trying to help you determine what's going on.

But if you don't want to answer questions here to help to try and troubleshoot what's going on, you can try asking in another subreddit such as r/Lenovo, /r/LenovoLaptops, /r/LinuxOnThinkpad, r/thinkpad, /r/ThinkpadsRunningLinux and so forth.

Regards,

Aryeh Goretsky

Hello,

The only other suggestion I have is to go to the media about what happened, but that is something to carefully think about if you do not want to go public with what happened.

Again, I'm so sorry this happened to you, and I hope that you get a good resolution that lets you move forward with your life.

Regards,

Aryeh Goretsky

Hello,

It sounds like an information stealer was run on the computer.

What is an information stealer?

As the name implies, information stealers are a type of malware that steal any information they can find on your computer, such as passwords stored for various services you access via browser and apps, session tokens for accounts, cryptocurrencies if they can find wallets, etc. They may even take a screenshot of your desktop when they run so they can sell it to other scammers who send scam extortion emails later.

What is a session token?

In case you're wondering what a session token is, some websites and apps have a "remember this device" feature that allows you to access the service without having to log back in or enter your second factor of authentication. This is done by storing a session token on your device. Criminals target these, because they allow them to log in to an account bypassing the normal checks. To the service, it just looks like you're accessing it from your previously authorized device.

What exactly gets stolen?

Information stealers are malware that is sold as a service, so what exactly it did while on your system is going to vary based on what the criminal who purchased it wanted.

What happens to my data?

The criminals who steal your information do so for their own financial gain, and that includes selling information such as your name, email address, screenshots from your PC, and so forth to other criminals and scammers. Those other scammers then use that information in an attempt to extort you unless you pay them in cryptocurrencies such as Bitcoin, Ethereum, and so forth. This is 100% a scam, and any emails you receive threatening to share your private information should be marked as phishing or spam and deleted.

How did I get infected in the first place?

Information stealers are often distributed as fake CAPTCHA challenges, in game mods, unofficial patches for popular apps and games, and in pirated software that have had their popularity and trustworthiness artificially boosted, as well as through various other means such as "try my game/software" scams on Discord, Telegram and other trusted messaging services.

If I ran an information stealer, am I still infected?

Infostealers usually delete themselves after a few seconds or even a minute or two in order to make it harder to determine what happened and when it occurred.

That said, there are always going to be exceptions: Since it is crimeware-as-a-service, there is nothing preventing the criminals from installing additional malware on the computer in order to maintain access, just in case they want to come back and steal from you again in the future.

What else could they have done?

The usual risk post-infection, aside from the stolen credentials, wallets, etc. is that security and networking settings may have been tampered with. That can be harder for security software to deal with, since it may not know what the correct settings are supposed to be for your computer, which means it may be a good idea to wіpe the computer, even if there is no longer any malware detected on it.

How do I start the recovery process?

If you have another device that didn't run the information stealing malware like a smartphone or tablet, you can use it to begin immediately changing your passwords. You should also enable two-factor (sometimes called multi-factor) authentication, for those services that support it. If possible, install and use an authentication app on your smartphone: Apple, Google, and Microsoft all have free versions of authentication apps. Using an app for 2FA is preferred over using SMS (text messages) or email, as the attackers may have access to these.

If any of the online services you use have an option to show you and log out all other active sessions, do that as well.

As for your computer, after wіpіng it, re-installing Windows, and getting that updated, you can then also use it start accessing the internet to do this, but it is often quicker to change your most sensitive accounts from your smartphone.

A note about passwords

Password should be something unique (complex and different) for every service, that you use, so that if an attacker gets access to one they won't be able to make guesses about what your other passwords might be. If your new passwords are similar enough to your old passwords, a criminal with a list of all of them will likely be able to make educated guesses about what your new passwords might be for the various services.

You have to do this for all online services, even ones you haven't been recently accessed. Make sure you do this for all email accounts, as those are the gateways to your financial websites, online shopping, social media accounts, game platforms, and so forth.

It's important to make sure you're not just cycling through similar or previous passwords: Remember, criminals have millions of passwords and are very good at identifying common patterns from just a single password. If there were any reused passwords, the criminals who stole yours are going to try spraying those against all the popular online marketplaces, stores, banks, and other services in your part of the world.

And remember: Enable two-factor authentication for all of the accounts that support it.

For more information:

For more specific information on what steps to take next to recover your accounts, see the blog post at:

• WeLiveSecurity (ESET) - https://www.welivesecurity.com/en/cybersecurity/my-information-was-stolen-now-what/.

For more general information about how CAPTCHA malware works, see the following reports:

• Arctic Wolf - https://arcticwolf.com/resources/blog/widespread-fake-captcha-campaign-delivering-malware/
• Kaspersky - https://securelist.com/fake-captcha-delivers-lumma-amadey/114312/
• Malwarebytes - https://www.malwarebytes.com/blog/news/2025/03/fake-captcha-websites-hijack-your-clipboard-to-install-information-stealers
• Netskope - https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection
• Qualys - https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha)

Also, see /u/rifteyy_'s Guide to Infostealers at https://rifteyy.org/report/the-ultimate-guide-to-infostealers.

After you have secure your accounts, you may wish to sign up for a free https://haveibeenpwned.com/ account, which will notify you if your email address is found in a data breach.

Regards,

Aryeh Goretsky

Hello,

MGK is ESET's distributor in the Benelux region. From looking at https://www.eset.com/lu-fr/apropos/contact/, you can contact them directly at +352 26 18 51, or use the form at https://www.eset.com/lu-fr/professionnels/contact-sales/.

Regards,

Aryeh Goretsky

Hello,

Keys to get into the BIOS are going to vary based on the generation and model of Lenovo computer--they have made thousands of different models over the years. Did you try this and did it do anything at all?

Regards,

Aryeh Goretsky

Hello,

I am sorry to hear you are having to deal with this.

In Colorado Springs, your congressperson is Jeff Crank, and he is your public servant/guide/sherpa/advocate for dealing with federal government bureaucracy. I know he gets a lot of shade thrown at him in this subreddit, but nevertheless , it is literally his job to help you.

My suggestion would be to reach out to his office and see what sort of assistance they can provide in expediting your care: https://crank.house.gov/contact

If they are unwilling or unable to do so, I am sure local media would be fascinated to talk with you.

Regards,

Aryeh Goretsky

Hello,

The 7/11s on 21st St near Cimarron and on 8th St near Arcturus both have machines that will grind and brew a fresh cup of coffee.

Regards,

Aryeh Goretsky

Hello,

I just tried going to https://old.reddit.com/message/compose/?to=/r/antivirus, and it redirected me to https://www.reddit.com/message/compose/?to=/r/antivirus, which seems to work.

You could also try https://sh.reddit.com/message/compose/?to=/r/antivirus if the above does not work for you.

Regards,

Aryeh Goretsky

Hello,

Oh, absolutely.

Also, those forensics kits start at about $5K, and go up to at least $30K, depending upon what features you license. Typical customers are government (law enforcement, military, intelligence community), but you might be able to purchase them if you are an enterprise and employ forensics staff with certifications.

Since you mentioned educational use, I'll also note that unless your university has a history of collaborating with government agencies on national security matters, you probably are not going to be allowed to purchase these devices and associated licenses/maintenance. If you were allowed to, expect the devices to be stored in a restricted access lab, with controls on not just what people entered and left the secure space, but what devices as well.

For the protocol analyzers, it looks like they start at a few thousand dollars, but go up to over $150K, depending upon feature set. These would probably be easier for your electrical engineering department to get, though.

All prices US dollars.

Regards,

Aryeh Goretsky

Hello,

Does holding down the F12 key, powering the device up, and keeping the F12 held down until it beeps and offers you an option to go into the BIOS do anything?

Regards,

Aryeh Goretsky

Hello,

Do you have any security software installed that performs anti-keylogging/keyboard scrambling to prevent your keystrokes from being copied? If so, try disabling it and seeing if that makes a difference.

Regards,

Aryeh Goretsky

Hello,

It sounds like you're looking more for a mobile forensics kit. Here are a few to get you started with what's available in the space:

• Cellebrite - UFED
• Exterro - FTK
• Magnet Forensics - GrayKey
• OpenText - EnCase Forensic

If you are just interested in raw device communications, a protocol analyzer might better meet your needs. Here are a few to start with:

• Anritsu - Signal Quality Analyzer-R MP1900A
• Ellisys - Ellisys USB Explorer 350
• Teledyne LeCroy - Voyager M480x USB4 Protocol Analyzer
• TotalPhase - Beagle USB 5000 v2 SuperSpeed Protocol Analyzer - Ultimate Edition

A former employer of mine built test equipment for data communications (telephony applications, not USB) about 25 years ago. I don't know the costs, but they started with a staff of 6-8 hardware engineers; I would assume with hardware like the above being on the market, plus all of the research being done now, that it would be a lot less expensive these days.

Regards,

Aryeh Goretsky

Hello,

Below is a copy of the instructions we use in r/antivirus, which is kind of a sister subreddit to this one that just handles in computer virus and malicious software issues, for dealing with information stealing malware.

---

It sounds like an information stealer was run on the computer.

What is an information stealer?

As the name implies, information stealers are a type of malware that steal any information they can find on your computer, such as passwords stored for various services you access via browser and apps, session tokens for accounts, cryptocurrencies if they can find wallets, etc. They may even take a screenshot of your desktop when they run so they can sell it to other scammers who send scam extortion emails later.

What is a session token?

In case you're wondering what a session token is, some websites and apps have a "remember this device" feature that allows you to access the service without having to log back in or enter your second factor of authentication. This is done by storing a session token on your device. Criminals target these, because they allow them to log in to an account bypassing the normal checks. To the service, it just looks like you're accessing it from your previously authorized device.

What exactly gets stolen?

Information stealers are malware that is sold as a service, so what exactly it did while on your system is going to vary based on what the criminal who purchased it wanted.

What happens to my data?

The criminals who steal your information do so for their own financial gain, and that includes selling information such as your name, email address, screenshots from your PC, and so forth to other criminals and scammers. Those other scammers then use that information in an attempt to extort you unless you pay them in cryptocurrencies such as Bitcoin, Ethereum, and so forth. This is 100% a scam, and any emails you receive threatening to share your private information should be marked as phishing or spam and deleted.

How did I get infected in the first place?

Information stealers are often distributed as fake CAPTCHA challenges, in game mods, unofficial patches for popular apps and games, and in pirated software that have had their popularity and trustworthiness artificially boosted, as well as through various other means such as "try my game/software" scams on Discord, Telegram and other trusted messaging services.

If I ran an information stealer, am I still infected?

Infostealers usually delete themselves after a few seconds or even a minute or two in order to make it harder to determine what happened and when it occurred.

That said, there are always going to be exceptions: Since it is crimeware-as-a-service, there is nothing preventing the criminals from installing additional malware on the computer in order to maintain access, just in case they want to come back and steal from you again in the future.

What else could they have done?

The usual risk post-infection, aside from the stolen credentials, wallets, etc. is that security and networking settings may have been tampered with. That can be harder for security software to deal with, since it may not know what the correct settings are supposed to be for your computer, which means it may be a good idea to wіpe the computer, even if there is no longer any malware detected on it.

How do I start the recovery process?

If you have another device that didn't run the information stealing malware like a smartphone or tablet, you can use it to begin immediately changing your passwords. You should also enable two-factor (sometimes called multi-factor) authentication, for those services that support it. If possible, install and use an authentication app on your smartphone: Apple, Google, and Microsoft all have free versions of authentication apps. Using an app for 2FA is preferred over using SMS (text messages) or email, as the attackers may have access to these.

If any of the online services you use have an option to show you and log out all other active sessions, do that as well.

As for your computer, after wіpіng it, re-installing Windows, and getting that updated, you can then also use it start accessing the internet to do this, but it is often quicker to change your most sensitive accounts from your smartphone.

A note about passwords

Password should be something unique (complex and different) for every service, that you use, so that if an attacker gets access to one they won't be able to make guesses about what your other passwords might be. If your new passwords are similar enough to your old passwords, a criminal with a list of all of them will likely be able to make educated guesses about what your new passwords might be for the various services.

You have to do this for all online services, even ones you haven't been recently accessed. Make sure you do this for all email accounts, as those are the gateways to your financial websites, online shopping, social media accounts, game platforms, and so forth.

It's important to make sure you're not just cycling through similar or previous passwords: Remember, criminals have millions of passwords and are very good at identifying common patterns from just a single password. If there were any reused passwords, the criminals who stole yours are going to try spraying those against all the popular online marketplaces, stores, banks, and other services in your part of the world.

And remember: Enable two-factor authentication for all of the accounts that support it.

For more information:

For more specific information on what steps to take next to recover your accounts, see the blog post at:

• WeLiveSecurity (ESET) - https://www.welivesecurity.com/en/cybersecurity/my-information-was-stolen-now-what/.

For more general information about how CAPTCHA malware works, see the following reports:

• Arctic Wolf - https://arcticwolf.com/resources/blog/widespread-fake-captcha-campaign-delivering-malware/
• Kaspersky - https://securelist.com/fake-captcha-delivers-lumma-amadey/114312/
• Malwarebytes - https://www.malwarebytes.com/blog/news/2025/03/fake-captcha-websites-hijack-your-clipboard-to-install-information-stealers
• Netskope - https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection
• Qualys - https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha)

Also, see /u/rifteyy_'s Guide to Infostealers at https://rifteyy.org/report/the-ultimate-guide-to-infostealers.

After you have secure your accounts, you may wish to sign up for a free https://haveibeenpwned.com/ account, which will notify you if your email address is found in a data breach.

Regards,

Aryeh Goretsky

Hello,

Understood. Unfortunately, there's no easy way I've found to identify victims of account takeovers, at least, not without generating a lot of incorrect automatic responses.

And as bad as it seems here, it is much worse in r/antivirus, which is kind of a sister subreddit to this one that deals specifically with these types of issues.

Regards,

Aryeh Goretsky