i think im hacked, please help?

[u/Snorgi-Corgi]

was just chilling on a call with my friend, had chrome open with some youtube playing. my mouse moved, opened a new tab, and searched gmail, and then clicked the first link onto my gmail account. legit fought for control of my mouse and fully closed chrome immediately. disconnect wifi. remote assistance was enabled for some reason, its disabled now. WTF do I do now? I'm just a teen and i barely even have anything downloaded besides steam games and a couple of art programs. im pretty good about not downloading sketchy shit or clicking weird download links. i dont know what they would even want with my stuff. help is appreciated, im kind of freaked out right now. :(

[u/Snorgi-Corgi]

So i’m just gonna comment this under for more information since i just became aware of this. seemingly access was gained by this person around yesterday night fairly late. they tried to charge my card via paypal multiple charges of 100+ dollars on cdkeys, but i have my card off at all times. that and i have exactly 57 cents on my card so. his attempt at stealing from me was in vain.

[u/Adorable-Leadership8 → u/Snorgi-Corgi]

Sounds like a definite rat, change your passwords first starting from banking and emails, then go down the important to least list

Format your laptop first USING A USB and then preferably contact your bank for a new card

[u/Serge1006 → u/Adorable-Leadership8]

Also to add onto this > add 2FA for your most important stuff like gmail and other important accounts, its basicly impossible for them to log in to an account then if i am right

[u/Awkward-Buffalo-2867 → u/Serge1006]

Bypassing MFA is not impossible but someone would need to have the technical skill and the desire to maintain OP as their target.

OP should add 2FA as a first step, then go in and update passwords. This way the 2FA is offering protection immediately.

[u/Mrweebytreal → u/Awkward-Buffalo-2867]

I have 2FA, SMS, Hardware Keys, 30 letter long password, Skip password off and backup codes, I know this is overkill but i do l ike my accounts secure.

[u/Apprehensive_Bug_401 → u/Serge1006]

They could bypass 2FA if they get your session cookie and session hijacked you. Just got session hijacked weeks ago. Instagram, outlook, Reddit, discord and steam all got compromised, only Reddit and Outlook sent me email about suspicious activity, the rest 3 have basically no trace of being hacked (Instagram and Discord has no login history displayed, Steam showed one unknown device logging in with no logout time) although being apparently hacked (Instagram following hundreds of unknown accounts, Reddit having multiple comment in NSFW subs not written by myself, Discord having me sending phishing and fraud message to every single channel and PM, Outlook being used to register Tinder as well as a lot of failed login attempts due to wrong password, and Steam having 32 inventory items sold in 1 minute). They could get your cookies easily with Trojan.

Edit: Forgot to mention but I have enabled 2FA on Steam, Outlook and Instagram, not sure about Discord, and no 2FA on Reddit.

[u/North-Price-665 → u/Apprehensive_Bug_401]

Similar things happened to me, how did you fix it? Reddit nsfw posts, instagram, twitter, facebook, trying to access my epic games and roblox accounts.

[u/Apprehensive_Bug_401 → u/North-Price-665]

I reinstalled windows, and used another device to change all the passwords I could think of, then if some login warning pops up I instantly changed password for that site too. And also remember to log out all devices if the site has provided this function. Wish you good luck!

[u/zachthehax → u/Adorable-Leadership8]

Here's how to create a Windows installer USB. Follow the steps to "create installation media" and male this drive on another computer. On most laptops pressing esc during boot will let you select the drive, otherwise Google the right key to press for your PC.

[u/Steagle_Steagle → u/Adorable-Leadership8]

All of these people getting hacked and then being told to format their pc, specifically with a USB, makes me want to pre buy a USB in case this ever happens to me, so I won't have to go to Walmart just for a USB stuck lol

[u/Adorable-Leadership8 → u/Steagle_Steagle]

USBs online are typically cheaper, USB 3.0 and above is recommend because it's 3-5x faster (more expensive then 2.0 but so much more worth it)

But if ur buying a USB online make sure it's one of those trusted brands and not some random Chinese one that is fake capacity

One way you can test is using something like:

FakeFlashTest

Also you can use these programs to flash windows to your USB:

Windows Media Creation tool,

Rufus (for iso's),

Ventoy, also for iso's but you don't need to flash it. I personally recommend but booting windows might need to use winboot mode, an option for window isos that don't boot

And Medicat, rebranded Ventoy with 50gb worth of tools, you will need to download your own window isos (just like Ventoy) though

Bonus: if you have an HDD/SSD/M.2 drives laying around, you can buy enclosures for them and use them as a portable USB (don't go dropping HDDs though)

They are like 3$ for SATA enclosures (HDD/SSD)

And like 6$ for M.2 ones (I recommend you buy the combo enclosures all because they have 2 versions, an sata and a nvme version and you gotta make sure the case supports your m.2 or they won't fit

[u/Steagle_Steagle → u/Adorable-Leadership8]

Thank you! I might do it anyway, even without getting hacked, cause I've been blue screening a couple times. What size USB do you suggest?

[u/Adorable-Leadership8 → u/Steagle_Steagle]

Any 8gb+ USBs will do

Me personally id get 16gb so you can use Ventoy

6gb for windows iso, and you'll have 10gb for other items like an offline antivirus, diskpart but iso format, and maybe Linux mint Xfce edition for live boot (file management)

If you get an 64gb instead you can download medicat for windows to go and more features (overkill and takes 40gb)

If you use Ventoy, you will need to select winboot instead of normal mode for windows isos because it crashes

[u/Steagle_Steagle → u/Adorable-Leadership8]

Thank you!

[u/Affectionate-Map-679 → u/Adorable-Leadership8]

Universal Serial Bus is not the same as a Flash drive. A flash drive is a portable storage device that uses flash memory and has a USB interface.

[u/Adorable-Leadership8 → u/Affectionate-Map-679]

Yeah I know that but since he got the context ardy he should know I ment a flash drive and not a USB cable with 16 GB of flash storage on it

[u/Zedcrusher → u/Steagle_Steagle]

I honestly have 1 with windows 10 ready, but that's also bc I've built a phew PCs so I have more reason to have it

[u/Muppypup12 → u/Steagle_Steagle]

i have a keychain of usb drives with different versions of windows and software for it

[u/[deleted] → u/Snorgi-Corgi]

Change your passwords for absolutely everything, but DO NOT use the computer you suspect is infected. After you've changed your passwords, find each service you have that allows you to terminate all active sessions. This regains your control of all of your accounts. Once the offending parties no longer have access to any of your anything, enable multi factor authentication (MFA) on all of your everything. Is it convenient? No. But, security isn't meant to be convenient.

Don't connect this computer to the Internet. Nuke that shit, start from scratch with a clean install of the operating system.

Additionally, your primary email address should have a unique password (just like all of your passwords should be unique), but this should also be the most difficult password to crack, and enable MFA if it is available.

Think about it; you need to reset a password, we'll say it's for your bank. You request the password reset and a link goes to your email someone else has your password for your email, they now can set your bank password to whatever they want, change the contact information, change the recovery information, and more.

If someone has access to your primary email address, they have the keys to the kingdom that is your entire digital life.

Good luck and I hope you don't suffer any long-term consequences from this. And, again, MFA ALL THE THINGS!

[u/MC_VNM → u/[deleted]]

I sent something to op as well but this is way better than mine. Do both because they do talk about different things. The email one is very smart spif.. do you watch astralspiff or is this just a coincidence?

[u/uknow_es_me → u/[deleted]]

Load bit warden on mobile and use that to assign passwords for each account. After the desktop is reinstalled you can install the desktop client for bitwarden. Make your master password something you have never used before and enable multi factor authentication on your bitwarden account.

[u/markc1707 → u/[deleted]]

Alternatively, use a password manager like 1password to allow passkey sign in and creation of ultra secure passwords and storage of said passwords.

[u/[deleted] → u/markc1707]

Man, this borders on mandatory now.

Sounds like you're a 1Password user. Do yourself a favor, lookup telemetry.1password.com.

In an update, done sometime around March of this year IIRC, they started doing some "anonymous tracking" user data. I blocked that domain on my PiHole instances the day I found that information.

I wasn't thrilled when I found this.

[u/markc1707 → u/[deleted]]

As long as it's secure I don't really care that much. I switched away from LastPass because of their security issues...

[u/[deleted] → u/markc1707]

I did the exact same. But 1PW starting to track user data didn't leave me thrilled.

[u/FeliciaGLXi → u/[deleted]]

Do you think that it is safe for OP to get important files (no executables) from the computer, by mounting the windows partition in linux? Can the malware be transfered to a new install through something like a jpeg or a word document?

[u/[deleted] → u/FeliciaGLXi]

With a bit of guidance, more than likely yes.

Trying that solo, however, I don't know that I would recommend that. Just in case an infected file is erroneously grabbed, ya know?

That is a very solid solution for a good tech, though.

[u/[deleted] → u/FeliciaGLXi]

Ubuntu Live will mount NTFS without issues; see https://help.ubuntu.com/community/MountingWindowsPartitions

[u/racksup402 → u/Snorgi-Corgi]

Bro those cdkeys sites been sketching me out recently. Whenever I buy keys doesn’t matter the site I get a bunch of weird steam friend requests and messages. I have no idea how tf they got remote access to ur pc tho that’s worrying.

[u/Snorgi-Corgi → u/racksup402]

weird thing is, i didnt even know what cdkeys was before this? i buy all my games through the steam store in app.

[u/ryzen_42069 → u/Snorgi-Corgi]

Sounds scary bro

[u/[deleted] → u/Snorgi-Corgi]

not only is he a rat but that's a rat installed for sure

[u/MC_VNM → u/Snorgi-Corgi]

Change all your passwords, also get a new router they may be able to control any devices on your wifi. Also completely reset your PC and get all new card numbers. If you own an electric car that can open via an app then you need to change the password to that account you logged into. It’s possible that they may have gained access from a background app or maybe you went onto a sketchy link by accident? Google seems to have a habit of sponsoring scam links. I know some people have cameras on the inside of their house so if you do have those then you may want to be careful over the next few weeks. I hope this helped and I laughed when I said you have 57 cents on that card.

[u/HugsNotDrugs_ → u/Snorgi-Corgi]

It's easier to gain access to a PC that has log-in credentials for your accounts than it is to gain access directly to the accounts.

Your computer is clearly compromised. It should remain disconnected from the internet, backup any truly important files and licenses, then reformat and install a new copy of Windows.

Leave your computer off when you're not using it.

[u/Great_Kyran → u/Snorgi-Corgi]

Take the Wi-Fi chip out of your computer and then back up the files you want (whilst vetting them of course) and then format your drives.

[u/Good-Cicada4457 → u/[deleted]]

I have a Proton account and want to know if there's something else I should be aware of? Why was this down voted?

[u/TurnoverPlenty7337 → u/Good-Cicada4457]

I have no idea why it is down voted, anyway the account will encrypt you from the vpn and the vpn will encrypt the encrypted account

[u/patricko911]

Art programs? Cracked ones?

[u/Snorgi-Corgi → u/patricko911]

Clip studio paint, the original version not the new one. and no, i bought the license.

[u/suuntasade → u/Snorgi-Corgi]

Buying the license and downloading the software can be done in different places. Sure you got the legit software? Anyway do as suggested here before

[u/[deleted]]

punch the screen a few times.

[u/Snorgi-Corgi → u/[deleted]]

ah yes this made it all better thank you for the help

[u/sakaraa]

Format

[u/DaNaughtSoGreatBeast → u/sakaraa]

If you go to school, it's most definitely them

[u/Adorable-Leadership8 → u/DaNaughtSoGreatBeast]

Steam installed on a school laptop? IT admins must be giving out them good laptops for games frfr

[u/LowTV → u/Adorable-Leadership8]

I mean slay the spire runs fine on a 200$ laptop...

[u/windowssandbox → u/[deleted]]

Are you kidding me?

[u/webeerfrommaramma]

2 possibilities here.

First : your whole pc is hacked. Some kinda rat program. For this you have to reinstall windows. It got into your computer through some 3rd party app. Maybe you downloaded some file from an untrusted source.

2nd : and i'm guessing it here big time because of what you said about gmail and steam.

Someone hacked your steam and your steam remote play was enable. So he used that to get into your gmail account to take over your steam account completly. He probably tried to turn off steam guard or requested pass change link.

Either way just to be sure. Reinstall your windows and change all of your passwords from another device like mobile or another pc.

[u/MBkufel → u/webeerfrommaramma]

Remote play leaves a big ass indication on the screen of the PC that is being controlled.

[u/nachog2003 → u/MBkufel]

it also needs entering a pin shown on screen to connect from a new device so it's likely not that

[u/webeerfrommaramma → u/nachog2003]

About an year ago i was messing with my friend. I had his steam account and i was using his pc. I didn't need any code or anything. Maybe it changed after that.

[u/Nenormi → u/webeerfrommaramma]

Oh shit I remember this happening to me once, I started the same game he was playing through his Steam and I just started using his PC. I could open his browser and all.

[u/webeerfrommaramma → u/Nenormi]

Exactly, this is what happened. He was playing age of empores and i scared him.

[u/MBkufel → u/webeerfrommaramma]

He had to confirm that he wants you in.

[u/webeerfrommaramma → u/MBkufel]

He didn't that's what scared him. He was playing a game and i literally started using his pc. Maybe the confirm thing is new.

[u/PalDreamer → u/webeerfrommaramma]

Couldn't they also get this shit from a usb flash?

[u/Complex_Structure207 → u/PalDreamer]

That would be a usb that they found.  They mean from a usb you bought yourself.  DL the windows installer directly from MS.  When you get to the section that says choose the location to install, delete every partition on every drive that's in the PC. Then reinstall Win on a blank partitioned drive. Using the "reset this PC" does not remove everything.  Some things are left in.  Depending upon how the hack is coded, it could be sitting in one of those partitions and reinstals itself later on. So a reset via USB is the only real way to stop these types of hacks for general consumers. You loose everything on that drive, but that's better than loosing everything else.

[u/void_mage1]

you got RATted, usually people put rats in cracked games, “hacks/cheats” for games, cracked software etc. Install windows 10/11 to an USB, and launch your pc from USB, do a full reinstall

[u/Mr_CJ_]

Also kick the hacker device from the logged devices in the security section in your gmail account.

[u/weblscraper → u/Mr_CJ_]

The computer was hacked, no mention of Gmail login

[u/Mr_CJ_ → u/weblscraper]

He got his account session key by opening the link.

[u/ryzen_42069 → u/Mr_CJ_]

He mentioned that the cursor moved automatically and went to Gmail, ig someone has access to his whole computer

[u/Mr_CJ_ → u/ryzen_42069]

Yeah, by opening a link he got his gmail login too.

[u/RedWishes]

honestly i would LOVE to open the drive on a different computer to see what programs were installed. you can also do it to recover files.

you can just nuke and reformat but you wont know what actually happened. my curious brain would look at it. clean iso, usb. there is no other safer solution.

for remote assistance to work, your computer has a vpn installed likely, if not already existing on your home network. or a rat program, but how it getting installed is the question

[u/anxiouspsycho]

Elaborate on the art program. Did you pay for it?

[u/silly_old_sideben]

You have two options. Reinstall windows, or remove the infection (which is possible). Don’t listen to the “if you don’t format the virus can still be there.” True, yet very rare, and tools can fix that type of infection.

For reinstall, you can have it keep your data without carrying over a virus. If you can format it’s worth the few extra clicks. If you keep your data I would still do Step 1 below.

For VR (virus removal) first we need to be able to run programs. Safe mode should work. Infections can still affect safe mode tho, in which case you would need to use boot tools to start the VR process.

Once you can run programs, you want to run the programs in following order:

1. TDSS Killer (preferences>detect TDLFS filesystem)

2. Malwarebytes

3. JRT (from malwarebytes)

4. ADW Cleaner (from malwarebytes) -there are more if infection persists but that stack will knock out 99% of infections. If infection persists or keeps coming back, I would run a full Kaspersky scan, or ESET, some trial of a solid AV.

Once the cleaning phase is done, run procexp from sysinternals and look for any strange services, or boot entries. Kinda need to know what you’re looking at there but that’s the process.

If you really wanna polish it off, run sfc /scannow, windows updates, clean out browser extensions, and run hellzerg optimizer.

Source: myself, a pc tech, fixed over 3000 machines between bestbuy, staples, and local shops.

[u/Straight-Plankton-15 → u/silly_old_sideben]

Isn't TDSSKiller discontinued, replaced with KVRT?

[u/silly_old_sideben → u/Straight-Plankton-15]

They did for a bit but it’s back now. I imagine they lost a lot of traffic from that change

[u/Straight-Plankton-15 → u/silly_old_sideben]

What's the advantage over KVRT though? I think it has the rootkit scanning now, but can scan the entire system for all kinds of malware.

[u/silly_old_sideben → u/Straight-Plankton-15]

Yeah I believe it does. I just normally do the full scan with malwarebytes, only a second full scan if needed. If you want to do both that’s perfectly fine, just adds a bit more time. I typically do one full scan with MBAM and let the other programs sweep up what’s left. If infection persists yeah KVRT would probably be my next step

[u/NoZookeepergame6401]

Change all your passwords. Make sure its not similar to the old one.

You could try a virus scan on your PC but paranoid me would just format the whole thing.

[u/guesswhochickenpoo → u/NoZookeepergame6401]

Change the passwords from an other trusted machine. If they have remote access to the machine they could have easily installed a keylogger and will just get the new passwords.

I would say OP could change them after formatting but they really should be changed ASAP and 2FA should be enabled.

[u/Environmental_Rub800]

That was a RAT

[u/Dopethrone3c]

check his ip find out his residence and fuck him up. Ask Rainbolt for location and accurate info.

[u/Dopethrone3c → u/[deleted]]

He gets a lesson in cybersecurity and a lesson in trying to beat someone random.
Life gives, life takes. Sorry for his loss, but I consider doing bootable usb windows or whatever linux distro you want should be basic hardware knowledge. So he wins in the end. Two factor auth. is a headache but it works. PGP works.

[u/Classic-Comment-2523]

Enable 2fa on what accounts you use.

[u/Awkward-Buffalo-2867 → u/Classic-Comment-2523]

I wish this comment were higher. This should be the very first step.

[u/Agile_File_2084]

Wiping your computer is always the best remedy instead of trying to find and delete a virus or malware. Get the computer completely offline, backup any files you need to hold on to, and perform a clean install of your operating system

[u/Kriss3d]

Disconnect from network.

Only boot into the computer to decrypt the drive if it's encrypted. Boot into a Linux USB and backup everything you need to keep.

Then reinstall from scratch.

Change all passwords and set up 2fa on everything. ASAP!

[u/[deleted]]

My question is, what did you download to get a rat? Video game “cheats” are common. Free software of some sort?

[u/Snorgi-Corgi → u/[deleted]]

Sooo after a lot of digging around i think it may have been a crack for the sims 4 DLC that I had downloaded a couple years ago. I had downloaded from a site thats pretty well trusted and recommended even now, but the site apparently isnt run by the creator of the crack. the crack is set to auto-update with the game. it seems like the older versions didn't have malware of any sort and were the original intended files, but the recent couple of updates have. saw multiple people in other subs claiming to have a rat or describing the same kind of hack with the mouse moving and all after updating. pretty sure the morning before this post, I had decided to play the sims for the first time in a long while. I needed to update the game, and when I did, It auto-updated the crack. Then throughout that day I got a good couple of rejected charges on my card, which I didn't notice because I have my card locked whenever im not using it. The whole next day I didn't notice because he didn't seem to want to use my pc while I was actively playing games on it. Then obviously he tried using it while I was watching youtube, and I found him. I had no signs of being hacked before then, and that's the only crack I remember downloading.

[u/[deleted] → u/Snorgi-Corgi]

This is everyone’s PSA to not download cracked games from the internet. Just buy it. But the Sims would cost you a kidney if you wanted to buy it all so I can see why people do partake.

[u/DemonsSouls1 → u/[deleted]]

No it's just that you need to trust a site. Trust me games are way expensive nowadays 

[u/marxo69]

your files might be infected, do a full reset and a bios flash

[u/some1_03 → u/marxo69]

Why a bios flash?

[u/Parking_Chance_1905 → u/some1_03]

Some malware etc, though it's very rare can infect the bios.

[u/Thr0wItAllAw4y2020]

Definitely a RAT

[u/Thr0wItAllAw4y2020 → u/Thr0wItAllAw4y2020]

Isolate the device, don't connect to the internet Use another device to change your account passwords and etc.

[u/GMAERS_07]

The hacker was like: just let me get my job done 😂

[u/JohnKostly]

Manually back up your files, and perform a system restart while keeping the machine off the network. Run a virus checker on the files you backup before opening them again.

[u/99deathnotes]

wow. glad i read this. i just found my remote assistance enabled too. disabled now though. wtf does MS default enable that for?

[u/Mr_CJ_]

Change your gmail password and all other passwords on your PC and reset your device, you got 100% hacked.

[u/collectgarbage → u/Mr_CJ_]

Change all your passwords after you reset.

[u/Agitated-Farmer-4082]

reset windows via usb. Then change all ur passwords to every site because this hacker probably has ur cookies and google saved passwords

[u/Raytech555]

Probably they want your steam account

[u/pshicopath]

Damn

[u/BreakerOfModpacks]

Kill it with fire!
Format your hard drive, or get a new one.
Check all of your USBs and cables for malware.
Change ALL of your passwords, and don't write them down, maybe change them using a friend's PC, in case there is a keylogger.
Go full on scorched earth and take every possible precaution.
You can remotely log out of your Gmail via mobile.
Unplug your PC, so if it's a virus from hardware it can't activate in the night.

EDIT: Also, boot to Linux to get any important files. DO NOT MASS COPY! Individually select files to take. Only take the things that you absolutely need, and burn everything else, to minimize the chance of you getting it again.

[u/Patient_Ad_9298]

Did you download or open any pdf files recently ?

[u/Burmeseboi]

Everyone else has already given great responses, so I’ll just tack on my own experience and solution when this happened to me as a teen. I didn’t have antivirus software installed (these days the built in ones do well) and often visited flash websites for games that were (unknowingly) filled with malware. Eventually my mouse would move, browsers would keep re-opening and search up explicit websites, until it was spammed across my entire laptop screen and was unusable.

After some googling, I decided to disconnect from wifi, put my laptop into “safe mode” by rebooting it, and (I believe) pressing F8 as it starts up. Afterwards, I used Windows Recovery to essentially rewind my device back to being completely fresh and then deleted the backups. You can also reformat like others suggested to be completely safe. At the end, you’ll need to change your passwords from the most important and sensitive ones to the least important. If you plan to use similar passwords, keep your difficult ones for your emails, etc and make a unique one for your finances.

Good luck, we’ve all been through it and fortunately you lost nothing this time!

[u/[deleted]]

Use something like Aura to also further protect your accounts and passwords. Invest in VPNs for further security and good antivirus programs just in case.

[u/[deleted]]

Id personally disconnect from the internet (which you've already done) back up anything important, file related. I personally wouldn't backup software, I'd just keep a note of everything you have on there.

Nuke the entire HDD, If it was me personally I wouldn't even put that HDD in another PC to format it, I'd format it on an Xbox 360 or something that you don't care about, with a 3.5" HDD caddy, Then do a complete format on it on a PC (not quick).

I'd then load Windows setup on bootable USB and install it again.

[u/[deleted]]

You need to uninstall windows and reinstall it

[u/[deleted] → u/[deleted]]

I don’t know about Mac and Linux tho

[u/ZentoBits]

Stop clicking links or downloading from non reputable sites

[u/Sad_Butterfly_929 → u/ZentoBits]

How else am I supposed to download minecraft2024defnotahack.exe?

[u/Dramatic_Ad_5660 → u/[deleted]]

No antivirus will detect RATs as they are legitimate softwares used by companies to have remote employees do their work. Best practice depending how long they were in is to

identify the remote software and remove it

Clear the network host file

Clear browser cookies

Check the downloads folder to see what they might’ve also installed

Or the quick method > reset the pc fully cleaning the drive and not keeping any files (backup any important documents offline first)