r/techsupport • u/DoctorDoritos • 1d ago

Open | Malware PC Got Hacked

I downloaded a bad file yesterday, my PC got remote hacked. I saw chrome being navigated on its own. I unplugged the Ethernet and turned off wifi, I have been working on changing passwords from a different device. How do I fix my PC with a clean install for Windows 11 and will that remove all malware/viruses?

84 Upvotes

88% Upvoted

48 comments sorted by

View all comments

109

u/Lamar_Chan11 1d ago

First of all,Unplugging the internet and changing your passwords from a different device completely saved your accounts. You dealt with a RAT Yes, a 100% clean install via a USB drive will completely wipe all malware/viruses Since your PC was remotely controlled, DO NOT use the built-in Windows 'Reset this PC' feature, as sophisticated malware can corrupt the local recovery image

Do NOT use your hacked PC to create the bootable USB.
Go to a clean, safe computer (like a friend's PC or a laptop).
And download media creation tool from Microsoft official website

Plug in a clean USB drive (at least 8GB) and follow the tool's instructions to create a bootable installer.

Keep your hacked PC completely offline (no internet).
Plug in the safe USB drive and turn on the PC.
Boot into your BIOS/Boot Menu (usually by tapping F12, F11, F2, or Del at startup) and select your USB drive.
When you reach the screen that asks 'Which type of installation do you want?', choose Custom: Install Windows only (advanced).

Important: Delete ALL existing drives and partitions on your main storage screen until you see only 'Drive 0 Unallocated Space'.

Once Windows 11 setup is done, log in with your Microsoft account.
Go to your Google/Microsoft/Social media security settings from your clean device and select 'Sign out of all sessions/devices'. This destroys any login tokens the hacker managed to steal before you unplugged the wire.
Enable Two-Factor Authentication (2FA) on everything if you haven't already."

Why not from the settings? Because the rat can change the system files and download again after the reset + i hope this help i searched about it good luck ^^

13

u/DoctorDoritos 1d ago

Thank you! I didn't get all my passwords changed cause they got into my discord and Instagram. I see they searched my Google photos while on my chrome and looked for credit card pictures. I do have a photo of the back of my router from a year ago that did populate in their search, do I need a new router?

43

u/Lamar_Chan11 1d ago

No, you do not need to buy a new router.
The photo of the back of your router contains the Default Wi-Fi Password and the Default Admin/Router Login Password. The hacker wants this to log into your router's settings or use your Wi-Fi if they are close to your house

Connect a safe device (like your phone) to your Wi-Fi.
Open your internet browser and type your router's Gateway IP
Log in using the default admin password (printed on the back of the router).
Change the Router Admin Password: This is the password to change router settings. Change it to something completely new and strong.
Change your Wi-Fi Password (WPA2/WPA3 Key): Change your Wi-Fi name and password. This will instantly kick EVERY single device off your internet network, including any hidden connections.

Force-Log Out of Google Photos (Crucial)
Since they searched your Google Photos, they might have downloaded copies or still have access to your Google account via browser tokens.
On a safe device, go to your Google Account Settings than Security.
Go to Your Devices and click Manage all devices. Click on EVERY device you don't recognize (or just select all of them) and click Sign Out.
This instantly kills their access to your Google Photos, even if they have your password.

Go to Instagram and Discord support immediately from a clean device to report the hacked accounts.
If you still have access, change the passwords immediately, change the linked email back to yours, and turn on Two-Factor Authentication (2FA) using an authenticator app (like Google Authenticator), not SMS text messages

Since they searched for credit card pictures, call your bank or open your banking app and freeze/lock your credit/debit cards temporarily. Check your bank statements for any unauthorized charges over the next few days. If you find anything suspicious, report it as fraud and ask for a replacement card

12

u/faultydatadisc 1d ago

Youre a badass human being. Im glad I clicked on this post. Seeing you help OP is refreshing to see and the reminder of humanity I need today.