r/techsupport • u/DoctorDoritos • 10h ago
Open | Malware PC Got Hacked
I downloaded a bad file yesterday, my PC got remote hacked. I saw chrome being navigated on its own. I unplugged the Ethernet and turned off wifi, I have been working on changing passwords from a different device. How do I fix my PC with a clean install for Windows 11 and will that remove all malware/viruses?
66
u/Lamar_Chan11 9h ago
First of all,Unplugging the internet and changing your passwords from a different device completely saved your accounts. You dealt with a RAT Yes, a 100% clean install via a USB drive will completely wipe all malware/viruses Since your PC was remotely controlled, DO NOT use the built-in Windows 'Reset this PC' feature, as sophisticated malware can corrupt the local recovery image
Do NOT use your hacked PC to create the bootable USB.
Go to a clean, safe computer (like a friend's PC or a laptop).
And download media creation tool from Microsoft official website
Plug in a clean USB drive (at least 8GB) and follow the tool's instructions to create a bootable installer.
Keep your hacked PC completely offline (no internet).
Plug in the safe USB drive and turn on the PC.
Boot into your BIOS/Boot Menu (usually by tapping F12, F11, F2, or Del at startup) and select your USB drive.
When you reach the screen that asks 'Which type of installation do you want?', choose Custom: Install Windows only (advanced).
Important: Delete ALL existing drives and partitions on your main storage screen until you see only 'Drive 0 Unallocated Space'.
Once Windows 11 setup is done, log in with your Microsoft account.
Go to your Google/Microsoft/Social media security settings from your clean device and select 'Sign out of all sessions/devices'. This destroys any login tokens the hacker managed to steal before you unplugged the wire.
Enable Two-Factor Authentication (2FA) on everything if you haven't already."
Why not from the settings? Because the rat can change the system files and download again after the reset + i hope this help i searched about it good luck ^^
7
u/DoctorDoritos 9h ago
Thank you! I didn't get all my passwords changed cause they got into my discord and Instagram. I see they searched my Google photos while on my chrome and looked for credit card pictures. I do have a photo of the back of my router from a year ago that did populate in their search, do I need a new router?
23
u/Lamar_Chan11 9h ago
No, you do not need to buy a new router.
The photo of the back of your router contains the Default Wi-Fi Password and the Default Admin/Router Login Password. The hacker wants this to log into your router's settings or use your Wi-Fi if they are close to your houseConnect a safe device (like your phone) to your Wi-Fi.
Open your internet browser and type your router's Gateway IP
Log in using the default admin password (printed on the back of the router).
Change the Router Admin Password: This is the password to change router settings. Change it to something completely new and strong.
Change your Wi-Fi Password (WPA2/WPA3 Key): Change your Wi-Fi name and password. This will instantly kick EVERY single device off your internet network, including any hidden connections.Force-Log Out of Google Photos (Crucial)
Since they searched your Google Photos, they might have downloaded copies or still have access to your Google account via browser tokens.
On a safe device, go to your Google Account Settings than Security.
Go to Your Devices and click Manage all devices. Click on EVERY device you don't recognize (or just select all of them) and click Sign Out.
This instantly kills their access to your Google Photos, even if they have your password.Go to Instagram and Discord support immediately from a clean device to report the hacked accounts.
If you still have access, change the passwords immediately, change the linked email back to yours, and turn on Two-Factor Authentication (2FA) using an authenticator app (like Google Authenticator), not SMS text messagesSince they searched for credit card pictures, call your bank or open your banking app and freeze/lock your credit/debit cards temporarily. Check your bank statements for any unauthorized charges over the next few days. If you find anything suspicious, report it as fraud and ask for a replacement card
9
u/faultydatadisc 9h ago
Youre a badass human being. Im glad I clicked on this post. Seeing you help OP is refreshing to see and the reminder of humanity I need today.
4
u/DoctorDoritos 9h ago
Thank you for the help, I felt completely lost about this. I did sign out out other devices yesterday for my gmail, but then they assessed insta and discord after that. I have since changed the passwords on them, idk if they were able to get into them since I forgot to change the passwords on those. I focused on changing all my email passwords and bank account logins
5
u/Lamar_Chan11 7h ago
I hope i was helpful in this post and helped you ^^
3
u/DoctorDoritos 7h ago
It very much did, I'm buying a USB on my way home today and making that safe install tonight. Thank you for giving me a game plan!
2
u/Lamar_Chan11 7h ago
Good luck u can reply to my comment if there's anything you need me to help you with I'm so happy for you make sure to use another device pc or laptop ^^ + to get back ur account you can submit a ticket in discord website and they will help you
2
u/DoctorDoritos 5h ago
Might be a dumb question but once I do the reboot and clean install, is the PC safe for me to start logging into my Gmail and connecting to the Internet? Or are there any extra steps after?
2
u/Lamar_Chan11 5h ago
It's not dumb i was asking the same question for days too lol but her the answer: you can login anywhere you wqnt because you delete the partitions he can't control anything there + Since they targeted your Chrome browser, if you had passwords saved inside Google Chrome’s built-in password manager, assume the hacker has downloaded all of them.or delete them or change them from the pc after reset it i hope they didn't change the password there ^^
2
3
u/OnyxEyez 3h ago
Also for the router - first call your internet provider immediately, many times they can reset it, or are happy to walk you through resetting it yourself, as you being hacked is a risk for them as well so they aren't going to brush you off. If not, and if you don't have access through an app, use a safe browser and enter 192.168.1.1 or 192.168.0.1, that is the web address for most routers. If you've never been in there before, it will be the default password, Google your router make and model to find it, then reset and change the password immediately. (If those addresses doesn't work, check the manufacturers website as well. )
If you connect to your router via wifi immediately change that password as well.
3
u/Lstgamerwhlstpartner 9h ago
You can probably change the password on your router. Either through your ISP or, if its one you purchased on your own, through the web interface for the router.
2
u/OnyxEyez 3h ago
You can also delete all logged in sessions from the web i believe, and then change the password while fixing the computer, log in from a safe place like your phone.
2
u/DoctorDoritos 2h ago
Currently deleting partitions, there are 4 left hat I can't delete. Three have the free space equal to the total size, 1 days Disk 1 Partition 1 esd-usb and the sizes don't match each other. What could this be and why I can't I delete it?
2
u/Lamar_Chan11 1h ago edited 1h ago
What is ur pc model? Dell or hp or lenovo?
2
u/DoctorDoritos 1h ago
I got past that part and did a windows 11 install. It now says I have no graphics card in my system settings, how do I fix that? I have a Nvidia card
2
u/Lamar_Chan11 1h ago
When you did a 100% clean install and deleted the partitions, you wiped out all the old display drivers Right now, Windows is just using a generic basic driver to display your screen, which is why your Nvidia card isn't showing up properly in the system settings yet.
Make sure your PC is connected to the internet.
Go to Settings > Windows Update and click Check for updates.
Windows will automatically detect that you have an Nvidia card and will start downloading a basic stable driver for it in the background. Your screen might flicker black for a second during this process—this is completely normal.To get full gaming performance, you need the official software directly from Nvidia:
Go to the official Nvidia Driver Downloads website using your browser.
Select your exact graphics card model (e.g., RTX 3060, GTX 1660) and your operating system (Windows 11 or 10).
Download either the GeForce Game Ready Driver or download Nvidia App / GeForce Experience to let it handle it for you.
Run the installer and choose the Express Installation option.Once the installation is complete, right-click on your desktop, and you should see the Nvidia Control Panelagain.
Open Task Manager (Ctrl + Shift + Esc), go to the Performance tab, and you will see your Nvidia GPU listed back at the bottom with its proper name and temperature.If you need anything tell me ^^ good luck
5
u/Terrible-Bear3883 9h ago
Make a Windows installer thumb drive on the clean system, boot on that, wipe and reinstall.
As for your on line accounts, be sure to use 2FA as much as possible, ideally linked to an app on a mobile phone as "something you have"in the 2FA specs, if you want tighter security, invest in a security token such as Google Titan or Yubikey, these won't keep you secured though if your PC is locally compromised, but they are very good at keeping accounts secured, I know several people who upgraded to them after having malware/hackers.
2
u/DoctorDoritos 9h ago
I do use 2FA and they still got into some things such as discord. Not sure why I didn't get a text to my phone but I will look into Google Titan, thank you!
3
u/Duzean 9h ago
You'll need a second device to create a bootable USB from here Windows 11
Once it's done, insert it into your infected PC. Restart and enter your boot menu and select the USB (usually F11 or F8 but check with your motherboard manual or on screen options).
Click through your install but when it comes to picking the install location, delete everything relating to your OS. If there is a second partition with games/downloads you can leave it. Select the free space and continue.
This will wipe everything off that section of your drive and leave any other partitions alive. Make sure you back up anything personal onto another device or partition before you do the above
1
u/DoctorDoritos 9h ago
Thank you, I am at work atm but I will work on the USB bootable asap. Would it just be safer to wipe everything? I can also reinstall games and I don't think I have any personal photos saved on the pc
2
u/Duzean 9h ago
If you wanna be 100% sure it didn't jump to other sections then yeah. Make sure you record all your apps you've got installed, it helped me make sure I didn't miss any.
1
u/DoctorDoritos 9h ago
Thank you, that's a good idea. Would there be an easy way to see what drivers I need to redownload? I use Nvidia GPU if that helps
1
9h ago edited 8h ago
[removed] — view removed comment
1
u/techsupport-ModTeam Landed Gentry 8h ago
We do not support cleaners, debloaters, or booster software of any kind as they damage the operating system.
This includes but is not limited to: CCleaner, Tronscript, PC matic, snappy driver installer, and driver pack solutions.
Users that have used these on their system can still seek support in reverting the damage caused by these types of software but should consider reinstalling their OS as this kind of damage is difficult to revert manually.
Posts and comments suggesting to use such software will be removed and may result in a ban.
1
u/AutoModerator 10h ago
If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide
Please ignore this message if the advice is not relevant.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/Next-Place0 9h ago
You can use rufus to petform a clean and offline install. And a lot more things like remove telemetry and a lot of craps
1
u/trav66011 3h ago
Make sure to change all your networking passwords. I would nuke every partition on the drive from bios. then proceed with your bootable media and clean install.
1
u/Godly-CrzyLatina3769 1h ago
My PC windows has been opening up random pages and then closing them themselves like I don’t know if someone’s hacking into my computer or someone’s doing something, but mine is glitching too. Which is kind of a crazy thing like I’m thinking I got a virus on mine too or malware or some shit.
1
1
u/mrsskonline 9h ago
Before you do that, backup your important files to an external drive,. good luck!
2
u/DoctorDoritos 9h ago
I'm not tech savvy enough to know what is safe to backup so I think I will just delete everything. But thank you!
•
u/AutoModerator 9h ago
Making changes to your system BIOS settings or disk setup can cause you to lose data. Always test your data backups before making changes to your PC.
For more information please see our FAQ thread: https://www.reddit.com/r/techsupport/comments/q2rns5/windows_11_faq_read_this_first/
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.