You might have been targeted! Need assistance?
You might have been targeted! Need assistance?
Hello, I hope this message finds you well. I was just working on my PC when suddenly Internet Explorer launched a site. I believe it was about a PG Battlefield game (I haven’t played it), possibly the official page, and there was a small window with PayPal. You had to enter your phone code to log in. At the same time, my phone received two messages with different codes for PayPal. I quickly closed the PayPal window, the browser, and shut down the PC. It felt like someone was controlling my computer, similar to what you might experience with TeamViewer. Since I didn’t install any of those programs, I ended up turning off both my PC and phone for about 30 minutes. There hasn’t been a hacking incident since then, but it’s concerning. What should I do now? Should I reinstall Windows 11 from scratch and create a fresh phone installation? Or need to change passwords on Google, Gmail, PayPal, etc.? Any advice would be appreciated. And could you clarify what happened? Thank you.
Update your passwords immediately. If your bank information is stored via PayPal, obtain a new card. Reinstall Windows on your PC. Avoid trying to recover the item—this could worsen the situation. Simply reinstall Windows and reset all your passwords. Never log into an account without altering its password.
I tend to be a bit cautious about security, so yes, I’d follow all the steps you suggested and go beyond them. I’d shut the computer off to protect data and wipe all storage devices. You’re welcome to take more risks yourself. As for what occurred, it’s tough to pinpoint without understanding your system and routines. It might have been an email that secretly installed malware to mimic a teamviewer. Alternatively, it could be an internet attack if your router or ISP isn’t secure enough. Hope this gives you some clarity.
I've seen remote access trojans stored in Appdata several times that establish a TCP connection to a remote server. I'd usually find them using Resource Monitor. It won't be an installed application but simply a .exe operating in the background. They'll usually just sit and wait for useful information to steal but sometimes move the mouse to make sure its still connected if you're idle too long. I'd usually find them in C:\users\ username \appdata\roaming or local\apps, then nested down a dozen folders. It would try to disguise as a Microsoft Store Application in terms of file structure. If that's stuff you're not familiar with, simply do an offline Reset this PC. Offline so the malicious actor doesn't try to stop it.
If you encounter a virus and try to "back it up," you might end up with the infection too. Keeping backups while you're aware of or suspect a problem is definitely not advisable.
Just disconnect from the internet before proceeding with this or any other tasks that aren't a full format and reinstalling Windows. Although OP, if you don’t mind anything on your PC, just clear everything out—better safe than sorry. Heck, I’m not sure about the safety of things stored even in a non-C: partition, especially in your situation. There are ways to improve security, but honestly, I doubt OP will manage it well.
well yes and no... problem is malwarebytes needs to download av definitions to function... so at that point you just have to hope there aren't any shenanigans going on. basically even if mwb comes clean, that doesn't mean anything, lack of evidence is no evidence. you just gotta hope it actually finds something lol. ¯\_(ツ)_/¯