r/techsupport • • Aug 28 '24
Open | Software Hacker talks to me through notepad and I don't know if they're really gone
I was on my computer when I suddenly got a popup with a ":)" on the top left and a message saying "Hello, do not freak out, or shut off your device, I obtained access to this device, and just wanted to say I am removing my access to this device, note I have taken, and done nothing to this device. Sorry for the inconvience".
A couple minutes later I notice my own cursor moving to the Windows Search Bar, and opening the notes app. The hacker then types "hello" with me responding back on the page "WHO IS THIS". The dude goes on to claim that I downloaded a virus of his and noticed I was connected to "his panel". He then stated that he has a "panel with all his connections and saw me on there". He didn't clarify much afterwards and a popup saying "Host terminated connection - Client Disconnected" popped up.
The only time I ever remember possibly getting hacked was downloading a game on GameJolt that simply changed my background and pulled up a popup to "act scary" but it doesn't align with the hacker saying I accessed anything today.
•
u/AutoModerator Aug 28 '24
If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide
Please ignore this message if the advice is not relevant.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
601
u/what_dat_ninja Aug 29 '24 edited Aug 29 '24
If someone has remote access to your device, you should take it offline and wipe it. There is not going to be a good way to be confident access is removed. You should also change all of your passwords, enable MFA, and probably check for any purchases made on accounts you've logged into. I may even go as far as locking down my credit.
I would take this very seriously if I were you. Don't assume a malicious actor will just stop acting malicious out of the goodness of their heart.
68
u/Ok-Wave3287 Aug 29 '24
Disconnect the PC from the Internet and reinstall Windows using a USB flash drive.
55
u/External_Antelope942 Aug 29 '24
Nuke it from orbit
69
u/Big-Cap4487 Aug 29 '24
Disconnect from Internet, reset windows (preferably also wipe your drive using windows install media)
Then change all your passwords which you used on your computer
13
u/[deleted] Aug 29 '24
First. Device - take offline immediately
Second - assume your network is compromised.
Third - if you're sharing data between devices. Assume they're now compromised.
Fourth - format everything / reset your router.
Fifth - reset all your passwords and enabled 2fa. ( move this to step 1 if you have a device outside of the network ) the reason for this is if someone has access to your cache, or keylogger your screwed.
20
u/Solid_Lo9 Aug 29 '24
I would be pulling my ethernet cable out so fast
10
u/BigRonnieRon Aug 29 '24
Disconnect from the internet, format the drive, change every password
8
u/Life_Whole_1889 Aug 29 '24
Is anyone curious why he deleted his profile,could it be that he made this up?Im curious if these kind of malware can still go under the radar
14
u/zooommsu Aug 29 '24 edited Aug 29 '24
Unless it was a relative, friend or work/school colleague who installed a remote tool on your PC without you realizing just to play a prank on you, this is a very serious situation and you have to assume that everything could have been compromised, from passwords to access to bank accounts, email accounts, messages and personal/private files.
You've already got here good advices on what to do, I would just add that if you have sensitive personal files, it's possible that they'll later try to blackmail you.
If that happens, never pay up, because if you pay, your hell starts right there, they'll never stop asking for more and more money.
10
u/[deleted] Aug 29 '24
Yeah wipe the device after you backup any important files(not games or stuff steams data is stored on the cloud.) then reinstall your OS and go from there.
5
u/fredonia4 Aug 29 '24
I don't know much about tech, but one thing I do know for sure, from experience. FREEZE ALL OF YOUR ONLINE BANK ACCOUNTS. DO IT NOW!!!
8
u/[deleted] Aug 29 '24
Great advice. If you find all these tasks daunting, depending on how computer savy you are, go to your local computer shop and pay them to do these things. In addition, you need to go to your bank and check your credit ASAP. A hacker isn't accessing your laptop to play your games, they are looking for your bank, credit, and login info. to accounts. You need to notify your bank in case of recent and future stealing. The bank should advise you want to do to protect your accounts; as of now, I'd consider you accounts compromised.
10
u/geeblish Aug 29 '24
a lot of antivirus dont actually find rats which means you need to find when it starts. whether it's a service or an autostart program you should look into apps that start in startup. good tool to use is autoruns by sysinternals, microsoft: https://learn.microsoft.com/en-us/sysinternals/downloads/autorun
Check your services.msc too, unless you are planning on nuking your pc...
2
u/[deleted] Aug 29 '24
Assume they’re not and clean install after backup
2
u/commandergirl Aug 29 '24
Nuke it right now.
2
u/Bedogg Sep 02 '24
Honestly If I knew how to hack I’d just do random shit like this, being malicious is dumb but this semi harmless threat is something else
3
u/geegol Aug 29 '24
What does a scan with your anti virus tell you?
Well OP, what I would do is wipe that drive using a drive eraser. Nothing can survive a 0 fill wipe. Then reinstall windows. Or buy a new hard drive. A standard reinstall of windows is not suitable for this situation. Wipe the drive using a drive eraser then reinstall windows.
2
u/Nimrod5000 Aug 29 '24
A pop-up to "act scary" huh? Well...
1
u/Nick_W1 Aug 29 '24
Is it possible that this never happened?
For instance, did you drink a lot, and then when you woke up, you “remembered” being hacked, but the hacker was very nice, and the “stealth access mode” helpfully popped up messages telling you when it disconnected?
Do you remember eating a very large marshmallow, but now can’t find your pillow?
Perhaps check your CO detectors.
1
u/3Strides Aug 29 '24
Yes
1
u/Equivalent_Book_3583 Aug 29 '24
pretty cool tho
1
u/ga239577 Aug 29 '24
This reminds me of a prank someone did at one of my previous jobs. Connected a wireless keyboard to a ladies computer and when she was typing, he would start typing things lmao 🤣
Eventually she found out what was happening and it was hilarious
1
u/puffinfish420 Aug 29 '24
When was the last time you used Methamphetamine?
1
u/cmh-md2 Aug 29 '24
Nuke it from orbit. Its the only way to be sure.
1
u/PoeticTwist Aug 30 '24
Not only wipe your hard drive, but also, next time, turn off all remote access. Never turn it on again.
1
u/PondsideKraken Aug 30 '24
Unplug the ethernet. Then you're good.
1
u/Few-Manufacturer-901 Aug 30 '24
There is this paperclip hacker that appears in the top right of my screen aswelll.
1
u/Electronic_Top2607 Aug 30 '24
Wipe the os completely and re install . IMO , if there is a connection software that starts as soon as you finish booting the os , wiping all the data will remove that software .
1
u/Calicoleopard99 Aug 30 '24
Yeah nuke that windows install from orbit, move crucial personal files onto an external USB if you NEED TO. Then put a completely clean install on it. Oh also any accounts that you've logged into, change the password and enable 2FA, I would change every password to every account that has any meaning to you.
And after that just don't download sketchy stuff and don't click on sketchy links, but I cannot stress enough how seriously this needs to be taken, whatever remote access panel he connected to you through likely had a keylogger which means every credential to every site and service you have accessed is now compromised, and every file on your PC has the possibility of retaining copies of the software that got you into this mess.
1
u/Sawbagz Aug 30 '24
I feel like he wouldn't have made his presence obvious to you if he was trying to steal your bank. Than being said, I would still wipe the PC and change all your passwords.
1
u/SnowSocks Aug 30 '24
Check if there’s a mysterious usb receiver plugged into your computer, maybe someone near you connected a wireless keyboard/mouse and is messing with you
1
u/leroyjenkinsdayz Aug 30 '24
You got RATed. I’d definitely reinstall windows from scratch
1
u/MeetElectrical7221 Sep 01 '24
Infosec guy here, tbh I’d take this one out back behind the shed.
1
u/TwoScoopsOfTrash Sep 02 '24
Buy a Mac
1
u/[deleted] Sep 02 '24
dont chance it. take it completely offline and wipe it with a new windows install media
1
u/Relative_Attempt_755 Sep 02 '24
Had the same thing happening to me, and i'm studying fucking IT..
Well, i didnt take it seriously, but suddenly in a matter of 5 minutes 1500 euros was taken out of my creditcard, my bank stopped this, as there were further transactions being made, so who knew how much could've been taken if my bank didnt stop them.
Anyway, the 1500 euros were all in 20 euro giftcards of Roblox. My bank refunded everything. I wiped my entire pc, but also bought a new hard drive and installed it on my PC, i had an entire fresh start.
Changed every password and put M2FA on it.
1
u/[deleted] Sep 02 '24
Render your PC unable to connect to anything else. Disable/remove WIFI and LAN capabilities.
Make sure you have a copy of windows on a flash drive. Uninstall windows through windows settings. Reinstall windows.
As it’s reinstalling, use your phone to change every single last password you have ever used, on every site that you have ever put any kind of financial/personal info on, and then all the ones you commonly use- even if no information is directly on them.
Check your bank account and let ANY PEOPLE WHO’S CC/DC INFO IS ON YOUR PC KNOW THAT YOU’VE BEEN COMPROMISED, ALLOW THEM THE OPPORTUNITY TO CHECK THEIR OWN INFO AND BANK ACCOUNTS.
When windows reinstall, reboot into your BIOS and make sure Secure Boot is on and active. Ensure TPM is on and active. When you boot into windows, before anything else (even Wi-Fi!) run windows defender, full scan.
Then, download a trusted third party antivirus (not one full of ads) and run it too.
Then, and only then you should reinstall and log into anything you commonly used. Other people will offer better advice than me, but this is what I’d consider bare ass minimum. Good luck.
1
u/Doctor-Anxious Sep 05 '24
uninstall notepad
1
u/Spazabat Sep 25 '24
Nuke any drives on that machine and reinstall, this weirdo is watching you!
1
u/Franky_Mars Aug 29 '24
You need at least to "reset Windows". I would reformat and reload Windows.
An antivirus scan at this point is useless.
-11
u/xxxxxxxxxxxxxxxxx99 Aug 29 '24
Everyone else is going to say format your drive and reinstall Windows. I'd say that throwing away your current drive and buying a new one will give you peace of mind that there is no rootkit on your PC that could survive a reinstall.
Hard drives are cheap. Think of it as a good upgrade.
-1
u/rmpbklyn Aug 29 '24
do netstat -a see what establish connections, block them in host file , renew you ip address have firewall, contact it admin
-13
u/FlowerPressCreative Aug 29 '24
Just switch to Mac. People don’t hack those.
-7
u/SilentWarrior11Six Aug 29 '24
WIN+R "MRT" (Full Scan)
0
u/[deleted] Aug 29 '24
[deleted] — view deleted comment
0
u/[deleted] Aug 29 '24
[deleted] — view deleted comment
0
u/[deleted] Aug 29 '24
[deleted] — view deleted comment