Victim triage · Windows
I pasted a command into the Run dialog. What now?
Written by Antonio Radu. Something wrong or out of date? corrections@clickfixreport.com
The keys that page told you to press opened the Windows Run box or a PowerShell window, and Enter ran the pasted text as a command under your own account. Work down this list in order — the explanation is below it and can wait.
Do this now
~15 MINUTES
Disconnect from the network. Do not shut the computer down.
Turn Wi-Fi off on this computer, or unplug its network cable.
Do not switch off your router. You need the internet on a different device for almost everything below, and turning off the router disconnects that device too.
A stealer finishes in seconds, so what it took has probably already gone and unplugging will not bring it back. Disconnect anyway: it stops a second stage being downloaded and cuts off remote control if a remote-access tool was installed. Do not shut down — anything installed starts again at the next boot, and powering off erases what is in memory, the only place a professional could still read exactly what ran.
Move to a different device for everything below.
Your phone, a tablet, or another computer. Do not change passwords on the machine you pasted on — anything still running there reads the new ones as you type them.
On your email account, sign out of every session — before you touch the password.
Stealers take session cookies first: the token your browser holds that says “this person already logged in”. Whoever has a copy opens your account without the password and without being asked for your second factor.
Changing the password does not log the attacker out — the stolen cookie keeps their session alive until you revoke it. You can change the password twenty times and they will still be reading your mail. In your account’s security settings, find the wording for it — “sign out of all devices”, “log out everywhere”, “active sessions” — and use it. Email first: it is the reset path to everything else you own.
Now change the email password.
With the old sessions dead, a new password does what you expect: it stops the attacker signing back in with the credentials they already hold. In the other order it buys almost nothing. Use one you have never used anywhere else, set from the clean device.
Re-enrol multi-factor authentication, and remove what was added.
A second factor the attacker controls is worse than none. Re-enrol yours where you have any doubt, and remove what you do not recognise: extra authenticator apps, keys or passkeys; a recovery address or phone number that is not yours; mail rules that forward or delete messages, so you never see the reset alerts; third-party apps with access.
Only now, work through your other accounts.
Same three moves each time, in the same order: revoke, change, check. Anything holding money first, then work accounts, then every site where you reused that password. Give each its own password from a password manager on a clean device — and if you had one on the machine you pasted on, read the second bullet under What the attacker probably took first.
If this is a work, school or shared computer, report it now.
Tell your IT or security team before you clean anything. They may want it exactly as it is, and they can check whether the same page reached anyone else.
Steps 1 to 4 carry most of the protection and need no technical skill.
What the attacker probably took
In the campaigns publicly analysed, the pasted line quietly downloads a second program and starts it — usually an information stealer, which uploads what it finds within seconds and often deletes itself. You probably saw nothing. That is what success looks like from the outside, not a sign that it failed. Assume the following are gone:
- Passwords and autofill saved in your browsers — every profile, every browser, not just the one that was open, including any card details stored there.
- Your password manager, if it was unlocked. Stealers look for the vault file on disk and for the browser extension in an unlocked state. If either was true, treat every credential in that vault as exposed — not only the ones you used that day — and change the master password from a clean device before you use it to set new ones.
- Session cookies. This is why step 3 comes before step 4.
- Cryptocurrency wallets — extensions, desktop wallet files, and anything resembling a seed phrase or private key. If a seed phrase was ever on that machine, treat it as public.
- Messaging and gaming tokens for Discord, Telegram, Steam and similar, which give account access without a password.
- Small files from Desktop, Documents and Downloads, swept by extension, plus a screenshot and a fingerprint of the machine.
How to see what you actually pasted
Optional, and safe — you are reading, not running. Worth doing if somebody is helping you: it turns “something happened” into a string they can look up.
Windows records what you typed into the Run box at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Open Registry Editor from the Start menu — type its name into search rather than using the Run box — and browse there. Entries are named a, b, c; MRUList records the order they were used in.
If you pasted into an interactive PowerShell window instead, the text is at %AppData%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt. A console the Run box launched with the command already attached leaves nothing there.
What to check on the machine
Still disconnected. Look for things created around the time it happened, named randomly or imitating a real product.
- Scheduled tasks and startup entries. Task Scheduler, and Task Manager’s startup tab. Anything launching a script, or a program from
AppData,ProgramDataorTemp, is hostile until proven otherwise. - Antivirus exclusions. Windows Security → Virus & threat protection → Manage settings. An exclusion you did not add is strong evidence that something blinded the scanner. If you find one, skip to reinstalling.
- Browser extensions and shortcuts. Remove extensions you did not install, then check the Target field of your browser shortcut — arguments after the program path force-load an attacker’s extension.
Then run a full Microsoft Defender scan and an offline scan (under Scan options), which scans before Windows loads. Treat a clean result as weak evidence: these payloads are rebuilt constantly. Do not search for “support” numbers or accept help from anyone who contacts you first — fake cleanup services are a standard second wave.
Decide whether you can keep using it
Once an unknown program has run under your account, erasing the machine is the only way to be certain. Everything else is a probability judgement.
- Reinstall if it held work data, source code, crypto keys, customer information or credentials you cannot inventory — or if you found an antivirus exclusion, a scheduled task or a startup entry you did not create.
- Scan, watch and carry on if it is a spare or family machine with nothing valuable on it and the checks above came back clean.
If you do: Reset this PC with Remove everything, or a clean install from a USB stick made on another computer. Copy out documents and photos only — never programs, installers, or a system image made after the incident — and set the new passwords before signing back into anything.
Over the next few days
- Watch for reset messages and sign-in alerts you did not trigger, and re-check your mail rules — attackers often add a forwarding rule again once the panic has passed.
- Read bank and card statements line by line; test charges of a pound come before the real ones. If money has already moved, call the fraud line now — they can sometimes stop a payment that is hours old.
- If a seed phrase or wallet file was ever on that machine, move the funds to a wallet created on a clean device. A stolen seed phrase does not expire.
- Anyone else who uses it needs the same three moves. Report it, too: the reference number is what banks and insurers ask for.
Nothing on this page asks you to run a command, download a fix, or paste anything into a terminal — and it never will. Any site that offers to solve this for you and then tells you to paste a command is the same attack a second time.