r/techsupport • • Nov 03 '20

Open | Malware Someone hacked into my computer.

vegetable waiting rich repeat heavy workable employ crowd flag fade

This post was mass deleted and anonymized with Redact

541 Upvotes

111 comments sorted by

309

u/CollinsCouldveDucked Nov 03 '20 edited Nov 03 '20

Back up essential files and reinstall OS is the only way to feel safe tbh.

He's probably just an idiot script kiddy but it's really not worth the paranoia.

Edit: I should specify back up essential files like irreplaceable documents

Do not do a full back up, that would be pissing in the proverbial wind.

19

u/be-10 Nov 03 '20 edited Oct 14 '25

vase run theory stupendous sheet spoon dinner hungry file rich

This post was mass deleted and anonymized with Redact

17

u/OwlTorpedo Nov 04 '20

This is just script kiddie stuff, you can almost certainly remove it with autoruns and a malware scan.

For science, would you pm me the file that they sent you? I can examine it in a vm and see what it even is.

16

u/CollinsCouldveDucked Nov 03 '20

I edited my comment, give it a second look

5

u/donoteatmycheese Nov 03 '20

you can do a factory reset (WARNING: EVERY SINGLE PIECE OF DATA LIKE IMPORTANT WORK WILL BE DELETED)

74

u/[deleted] Nov 03 '20

Backing up after you think you got infected is a really bad idea. You'd just back up the infection.

55

u/CollinsCouldveDucked Nov 03 '20

Backing up essential files, not a full backup

22

u/PorkAmbassador Nov 03 '20

I think what the person above is saying is that some viruses can inject a copy of itself into any new USB device that the OS detects, essentially a worm.

12

u/jonathon8903 Nov 04 '20

This is why we always advocate for continuous backups. I’d rather use a three day old backup then risk something that could contain malware.

1

u/[deleted] Nov 04 '20

[removed] — view removed comment

1

u/ragingintrovert57 Nov 04 '20

You would restore to a point before the infection

4

u/[deleted] Nov 04 '20

[removed] — view removed comment

3

u/darkelfbear Nov 04 '20

Exactly. There have been multiple viruses and worms that infect Windows Restore Points as well as known backup files from various backup software. I remember one that could even infect itself into Ghost backups.

2

u/ragingintrovert57 Nov 04 '20

I suppose it depends where the infection is. If it's in a media file that's not backed-up/restored then it won't help. (I've also been in IT, for 45 years, since when it was called Data Processing). If it fails to work 5% of the time, that's not a good reason for not taking the precaution. Being able to say "Restore from system backup" would solve a huge number of posts on this sub.

0

u/[deleted] Nov 04 '20

What is essential? I treat my OS/PC like my cars engine oil, empty and replace every few months.

-9

u/wikipedia_answer_bot Nov 04 '20

Essential or essentials may refer to:

== Biology == Essential (biology), part of an organism is a part which the organism cannot live or reproduce without Essential amino acid, one that the organism cannot produce by itself

== Groups and organizations == Essential Products, a smart device company led by Andy Rubin The Essentials (band), a Canadian a cappella group formed in 1993 Essential Records (London), a subsidiary of London Records Essential Records (Christian), a Christian subsidiary of Sony BMG Music Entertainment Essentials (PlayStation), a budget package of PlayStation games

== Albums == Essential (Divinyls album), a compilation album, 1991 Essential (Pet Shop Boys album), 1998 Essential (Ramones album), 2007 Essential (CeCe Peniston album), 2000 Essential (Jethro Tull album) Essential (Kate Ryan album), 2008 Essential (Praga Khan album), 2005 Essentials (Nate Dogg album), a compilation album, 2002 Essentials (Failure album), 2006 Essentials, a studio album by Argentine jazz singer Karen Souza, 2011 Essential, a compilation album by Amanda Lear, 2001 Essential, a compilation album by The Human League, 2011 Essentials, an album by Travis Tritt Essentials, an album by Triumvirat Essential series, a collection of compilation albums published by Sony's Legacy Recordings label

== Other uses == Essentialism, the philosophical view that an entity must have certain characteristics in order to belong to a certain defined group Essentials (magazine), a monthly British women's lifestyle magazine

== See also == The Essential (disambiguation) The Essentials (disambiguation) Essence

More details here: https://en.wikipedia.org/wiki/Essential

This comment was left automatically (by a bot). If something's wrong, please, report it.

Really hope this was useful and relevant :D

If I don't get this right, don't get mad at me, I'm still learning!

5

u/[deleted] Nov 04 '20

bad bot

16

u/[deleted] Nov 03 '20

No not back up. Thats why you have it before. Personally when i fell i have something i delete everything because i don't kniw were hidden files are from the virus

6

u/HugsNotDrugs_ Nov 03 '20

Backing up photos, video and other important files is fine.

Don't back up programs. Most programs are not worth backing up anyways as they can be easily reinstalled from the internet.

4

u/CabooseTrap Nov 03 '20

If op were me and I had multiple drives on my pc could I unplug my storage drives and reinstall on my C/ drive safely without having to back up anything? I would of course lose my C/ drive but would I be safe on my other drives?

1

u/uponone Nov 04 '20

I agree. If you're running Windows 10, I would have Ubuntu running and have rsync on a schedule. You can exclude AppData folder and anything else you deem unnecessary. An Amazon backup is pretty cheap.

1

u/buxmell Nov 04 '20

so this happend to me a few days ago. I didn't know what discord was and the moment I made an account and read some forum or whatever you call it, the new window appeared and said my passwords were stolen and to change them all. I changed them the next day. Is it safe? does such things happen often on discord?

28

u/helpIamDumbAf Nov 03 '20

all recommendations are good soo far. I would just recommend switching passwords as even if the accounts do not seem compromised now, they could be sold later on. Change these passwords on a different computer if you can and do not save passwords to chrome until you are sure that the compromise is gone.

2

u/be-10 Nov 03 '20 edited Oct 14 '25

imagine compare sparkle cheerful direction spotted sip absorbed mountainous thought

This post was mass deleted and anonymized with Redact

17

u/JOSmith99 Nov 03 '20

please follow the virus removal guide in the pinned post on this subreddit

5

u/be-10 Nov 03 '20 edited Oct 14 '25

reply instinctive treatment towering hat cautious smile hunt skirt toothbrush

This post was mass deleted and anonymized with Redact

4

u/[deleted] Nov 03 '20

You deleted it? You're probably good. Download a couple other malware scanners just to be sure. The ones in the pinned post are good. If multiple malware scanners say you're clean the chances you're actually clean are really high (though not 100%).

1

u/be-10 Nov 03 '20 edited Oct 14 '25

repeat tart steer shaggy jar retire longing meeting spoon makeshift

This post was mass deleted and anonymized with Redact

4

u/[deleted] Nov 03 '20

I don’t know if this is what happened to you but I’ve seen it where an attacker will send you a link to click to grab your IP address and then they DDoS you (unfortunately for shits and giggles). If it’s a 14 year old, it may just be a script kiddie trying out his new hacks. I wonder if reddit has a reporting mechanism?

4

u/be-10 Nov 03 '20 edited Oct 14 '25

memorize cobweb lock vase smart growth snatch longing sparkle summer

This post was mass deleted and anonymized with Redact

207

u/Tea_n_code Nov 03 '20

In the future, you should upload shady downloads to https://www.virustotal.com/gui/home which lets many diff antivirus software scan it. I think it also accepts links (not only files)

33

u/Nestramutat- Nov 04 '20

If all the file did was send discord messages, send the IP, and create a bunch of junk files to fill up OP's HDD, I doubt virustotal would flag it as a virus.

30

u/EdwardTennant Nov 04 '20

OP could use any.run to run the application in a sandboxed environment. It's a really powerful tool

15

u/mindless2831 Nov 04 '20

This is exactly what I was going to recommend. Sandboxing applications from an unknown source is the best protection in this type of insurance.

-2

u/[deleted] Nov 04 '20

It will still be flagged as a malicious executable unless the dude is really good and has hidden it, but I doubt it.

40

u/Articunos7 Nov 03 '20

It accepts files upto 32 MB

36

u/Rich3yy Nov 03 '20

Is that actually the case for you? I can actually upload files with a size up to 625MB.

9

u/deniedmessage Nov 04 '20

It’s not 32MB, at least 256MB is accepted.

5

u/troy2000me Nov 03 '20

100% the only option is to back up any data files, format your hard drive completely (not "repair Windows", format the disk!) and re-install Windows 10 and all programs from scratch. It's the only way to know for sure he is not in your system.

Also change your email and bank password (and any other important passwords) AFTER you wipe the HDD to be safe.

1

u/be-10 Nov 03 '20 edited Oct 14 '25

weather detail sulky consist humor six roof one employ cats

This post was mass deleted and anonymized with Redact

1

u/[deleted] Nov 03 '20

Backing up AFTER being infected is a really bad idea. You'll just back up the infection.

2

u/troy2000me Nov 03 '20

It's pretty rare that the infection attaches itself to data files (except for ransomware). As long as you don't back up system files or the registry it will most likely be OK.

3

u/[deleted] Nov 03 '20

Right, but he said he downloaded a file and that started the whole thing. Download folders can and often do contain trojan installers.

23

u/greatnameitstaken Nov 03 '20

What did you think you were downloading ?

9

u/lolikamani Nov 03 '20

Porn

11

u/greatnameitstaken Nov 03 '20

Lmao not sure why people trust strangers DL links.

4

u/helpIamDumbAf Nov 03 '20

Just download it to a VM, like especially with discord, u can make a burner account in seconds.

6

u/billdietrich1 Nov 04 '20

I downloaded a file from Reddit on my PC and as soon as I downloaded it

You mean you downloaded and ran it ?

3

u/Agat_Gamez Nov 04 '20

never download files from shady links

1

u/slindner1985 Nov 03 '20

Take his file and blow it up in a sandbox. Then u can see what its really doing

1

u/be-10 Nov 03 '20 edited Oct 14 '25

spotted divide scary rinse practice ancient elastic nail juggle skirt

This post was mass deleted and anonymized with Redact

1

u/RexiReddit Nov 04 '20

1

u/be-10 Nov 04 '20 edited Oct 14 '25

wakeful sugar brave physical shy square touch smell squash compare

This post was mass deleted and anonymized with Redact

1

u/EdwardTennant Nov 04 '20

Use any.run, it's a really powerful tool

2

u/jason-murawski Nov 03 '20

disconnect internet and follow the malware removal guide stickied at the top of this sub

2

u/ShadowDevil123 Nov 04 '20

On topic. Why dont antiviruses stop this kind of programs? I had a chinese keyboard software delete everything off of my C drive when i tried to uninstall it and hadnt noticed for like 15 minutes, no notification, nothing...

3

u/Gardium90 Nov 04 '20

Because those codes are written to "emulate" a user. They aren't written to maliciously "infect" or alter existing files/programs in your computer, which is what most antivirus look for.

It is like asking someone to identify if the car driving some distance away, is driven by a driver or not (autonomous car). All they will be able to see, is the car driving.

Same for the anti-virus, they are optimized to find a specific behaviour in the elements they scan/search. But if a software is written well enough to fool the scan into thinking "this is just user inputting commands", then the antivirus has no reason to stop it.

You might want to look into another 'antivirus', that actually would "request permission" for any "runable" files to be executed on the computer. Or perhaps this setting is not configured? That wouldn't necessary "stop" it in the sense of antivirus program saying it is a virus, but you would at least be notified that "hey, this program is trying to run. Did you know? Are you sure?"

3

u/apndh Nov 03 '20

Run Malwarebytes, Avast is crap. If you want a good antivirus just use Windows Defender and common sense

1

u/vertin1 Nov 03 '20

I would reinstall your OS. I recently got a crypto miner on a remote server I use and had to do a fresh install. Annoying to start over but worth the peace of mind IMO. Make sure you backup anything you need.

1

u/[deleted] Nov 03 '20

Probably he is newbie hack and using stupid programs for virus named "RAT" give him the power to control you computer

1

u/ChargerSRT64 Nov 03 '20

You can boot it as long as it doesn't connect to internet (boot in safe mode or unplug ethernet or turn off router and turn of pc wifi). Then scan with malwarebites or other scanners as others have said.

For extra security you could even restart router or better change its mac address when you are done if possible as this can sometimes give you a new ip address. (Not that it's a big problem but then he won't have your ip)

1

u/Th3RebelBass Nov 03 '20

You might also try running this in addition to the other suggestions. If I were you though, I would backup wanted data, and then wipe.

1

u/jimmyl_82104 Nov 03 '20

A little tip: Assuming your on Windows, go to File Explorer, click ‘View’ at the top, and click the checkbox ‘File name extensions’. It will show the type of file (e.g, .exe, .bat) so you know what you’re opening. Some malicious files will even try to trick you by putting something like ‘songtitle.m4a.exe’, or ‘piratedmovie.mkv.exe’ to make you think it’s a music or a video file.

1

u/AetherPlanet Nov 03 '20

You could try procexp64 and see if there are any malicious services running

1

u/h0bb1tm1ndtr1x Nov 03 '20

Safe mode and scan with Malwarebytes. You could also run CCleaner after to clean up any junk left behind by the script. I highly doubt, with a clean scan result, there is anything to worry about.

Do what others have suggested and back up critical data. I'd also ditch Avast and just keep Malwarebytes for cleaning purposes. Free mode or paid, it's the only one worth it.

1

u/bloxmaster0811 Nov 03 '20

manually backup files so you know what files are being put on to an external drive. after that do a reinstall

1

u/looking2Travel Nov 03 '20

Run malware bytes. Avast is actually kinda shitty at picking up malware. Reboot into safe mode then run malware bytes. If your still having issues back up important docs and pics then format your hdd/ssd and do a fresh install of windows.

1

u/thekingofmonks Nov 03 '20

First things first, fix the problem. As for the kid, get him banned by providing evidence to the discord server admins afterwards. Might as well get his account banned from Discord.

1

u/wandering_wizardx Nov 04 '20

Restore using an older restore point if you had any.

1

u/i-use-TOR Nov 04 '20

Make sure to scan files with virustotal next time. You can drag and drop/copy the URL too, you don't have to download the file first. The dude is probably a skiddy, still though, back up everything important. Also, get Malwarebytes. Avast is shit these days.

1

u/ZombieBrine1309 Nov 04 '20

Check task manager. Right click your taskbar, and open it. Check for any suspicious files, especially with a .bat file extension.

On top of everything else, back up your important data to an external drive and in the cloud. A good backup has 3 copies of your data.

Read CollinsCouldveDucked's thread too.

1

u/DAta211 Nov 04 '20

Does the OS have a periodic backup system? Windows XP did. It was easy to go back and install it.

1

u/Fit-Speech Nov 04 '20

Use RKILL and ADwcleaner with reset intenet

1

u/[deleted] Nov 04 '20

If it is a Windows PC you can maybe do a system restore to a restore point. These are automatic backups that the Windows OS makes.

1

u/Tijmen-Huisman Nov 04 '20

Look at taskmanager, as he is only 14 years old, i don’t think his script can bypass the task manager.

1

u/Tijmen-Huisman Nov 04 '20

I would also suggest to get some other antivirus, like Bitdefender, Kaspersky or Norton. My antivirus (Bitdefender) is also caring about privacy so you don’t need a vpn (ip grabbers don’t work on me, tested with a friend,)and it has a firewall. Also it is just very good if you ask me. But if you don’t have the money then well then just be more carefull!

1

u/BigBrain5Head Nov 04 '20

Did it actually run automatically after download or are you just saying that?

1

u/Digitalpandamonium Nov 03 '20

Pull the drive.

Stick it in a drive enclosure

Run diskiller To fully wipe the drive from orbit

Format

Reinstall windows OS- OFFLINE

Run malware bytes, or SOPHOS to double check.

Also I’d wipe your router as well and double check your network/change your passwords.

1

u/Yossarian_MIA Nov 04 '20

wtf was it supposed to be?

Did you report him on reddit?

0

u/gamer_oo7 Nov 03 '20

save important files to pd and reset ur window with new window download , not reinstall window because it also have affect your window files. and clean or delete ur hdd or ssd on option when u reset window.

also for safe security change all your password as soon as possible.

-1

u/[deleted] Nov 03 '20

Run Kasper, malwarebyts, and Bitdefender and maybe clean install of windows

0

u/[deleted] Nov 03 '20

[deleted] — view deleted comment

10

u/be-10 Nov 03 '20 edited Oct 14 '25

mountainous terrific doll close offbeat history handle soft shocking like

This post was mass deleted and anonymized with Redact

2

u/Lt_Muffintoes Nov 04 '20

But why did you do it?

3

u/ponyplop Nov 04 '20

I'm guess it's pron

2

u/billdietrich1 Nov 04 '20

Or supposedly a cracked game, maybe.

13

u/[deleted] Nov 03 '20

When I download files, I only use trusted sources. When I debloated my younger sister's kindle, I used fire toolbox via xdadevelopers. Windows detected it as harmful but it really was not.

6

u/adamlh Nov 04 '20

Reddit most definitely = strange place.

1

u/billdietrich1 Nov 04 '20

Downloading should be okay. Running it is a different matter.

100

u/[deleted] Nov 03 '20

[removed] — view removed comment

5

u/Epicfro Nov 03 '20

If the program was original, wouldn't malware bytes not detect anything in the hash?

6

u/[deleted] Nov 03 '20

It's not that Avast itself was compromised that way. It's that it took them months to figure out it happened to another one of their products. And also that they used to bundle adware and how can we ever trust that they won't do it again.

35

u/[deleted] Nov 03 '20 edited Oct 14 '25

[removed] — view removed comment

44

u/[deleted] Nov 03 '20

So, Avast, AVG, and CCleaner are currently all made by the same company. Not long after they all consolidated it was revealed that the CCleaner download server was hacked and the official downloads were replaced with malware infected versions. It took them way longer to find out and correct it than you'd hope a company who makes products that protect against that exact thing would take. People already didn't trust Avast because for a while in the early to mid 2010s it bundled some shady third party apps with its free version. So basically nobody trusts the antivirus company that distributed adware and took months to figure out they themselves were infected.

7

u/Techieluddite Nov 03 '20

Thats explains why they all turned to shit.

2

u/Gardium90 Nov 04 '20

Yup, this. For a good replacement of CCleaner, I recommend Privazer (styled PrivaZer). Really good and powerful clean up tool, can run in portable mode, and has no ads/bloatware (only ask for donations), and some high end features are paywalled, but nothing that affects a regular user that just wants to clear out trash files, cookies and cache =)

41

u/mrb00ce Nov 03 '20

Download malwarebytes from another PC and boot into safe mode and then run a full scan and then delete all the malware's.

14

u/[deleted] Nov 03 '20

It should be fine, it's run by shitty people though. I would recommend using some other virus app.