Hackers Are Draining Shift Up Gooner Crypto Wallets (Watch This To Check If You're Compromised)

If you are infected Close the launcher, or disconnect from the internet, so the attacker loses access. On Windows, remove the persistence: First delete HKCU\Software\Classes\CLSID\{E77CC89B-7401-4C04-8CED-149DB35ADD04} if it exists. The same CLSID also exists under HKLM on every Windows install, pointing to wpc.dll (WindowsParentalControls). Leave that one. Only the HKCU copy is malicious. Restart Windows. The DLL stays locked while it is loaded, even with every Chrome window closed (reported). If the key exists with an empty default value, delete it anyway: that is what the agent's own chrome_uninstall leaves behind. Then open %LOCALAPPDATA%\Google\Chrome\User Data\PlatformExperienceHelper\ and delete any subfolder whose name is a 64-character hex string and that holds platform_experience_helper.dll. Do not delete the whole folder: Chrome creates PlatformExperienceHelper itself for its own platform_experience_helper.exe and an empty LoadFeatures file, so the folder on its own is normal. Microsoft Defender Offline did not detect the DLL on one machine (signatures 1.463.110.0), so a clean antivirus scan does not mean it is gone. Reinstalling Windows is the safest option, because the attacker could run any command while the agent was active. From a clean device, change your passwords: NIKKE / Level Infinite first, then email, Discord, banking and every password saved in a browser. Turn on two-factor authentication. Log out of all sessions (Discord, Google, Steam, GitHub and others). The agent can steal browser cookies, which work without your password. Revoke and regenerate API tokens, SSH keys and any developer credentials (GitHub, npm, AWS, OpenAI, Anthropic and others). Move crypto wallet funds to a new wallet with a new seed phrase.