Please help, remote access???

[u/Puzzleheaded-Bar1464]

Context: I thought I had something called “yahoo redirect virus” and thought I had fixed it; I turned my laptop on the other day, had not touched it (discord is set to launch automatically) and I looked up to see it doing this.

Is someone accessing my desktop remotely and how do I evict them??? Please and thank you - Lenovo IdeaPad Flex 5 14IAU7 w/ windows 11

EDIT: I disconnected it from the internet immediately after recording this video, and have since powered it off. On another device, I have changed all of my passwords and selected “log out of other devices.” I am fortunate that thus far, there doesn’t seem to be any suspicious activity in my various accounts. Hopefully this will remain the case.

To everyone who feels the need to comment on the fact that I recorded a video, but has nothing helpful to contribute: congrats, you got me! I’m a big dumb idiot 🤡 who has never experienced this in their life, ever. It’s my first time. Hence, why I’m here in a subreddit that is dedicated to helping big dumb idiots such as myself. Y’all are a little slow, eh?

To those who have given me advice to help me keep my important files/data and protect my passwords and sensitive info, etc. THANK YOU!! I hope the first sip of your coffee is always the perfect temp, never ever burns your lip, ever!!

I am going to take it to a tech store to ensure the issue is resolved effectively, as this is clearly more than I am prepared to handle on my own.

[u/Struppigel]

Due to frequent attacks, all replies to this post must be approved by mods. Please try to be helpful.

CV mod team

[u/SnowStormYukikaze]

just unplug the ethernet cable and fresh install windows. :/

[u/QueenDahyun → u/SnowStormYukikaze]

Actively watching them access the pc is so funny

[u/eXeKoKoRo → u/QueenDahyun]

They did this to me, their back door is a Chinese antivirus that leaves a connection open for them. Removed that and closed them out through task manager lol

[u/NamesSUCK → u/SnowStormYukikaze]

Cut the hardline!

[u/vanIvan4]

Disconnect from internet, backup everything you need and fully wipe your PC. While your are installing fresh Windows - change all passwords while you still can.

[u/Puzzleheaded-Bar1464 → u/vanIvan4]

Wait really? Why what happened what does it all meeeeannn ):

[u/vanIvan4 → u/Puzzleheaded-Bar1464]

You clicked on something/installed something that allowed remote access to your PC.

[u/Puzzleheaded-Bar1464 → u/vanIvan4]

If I take it to like a geek squad or something, can they help me do this without losing my important files bc I have like a million photos on here I want to keep - and not sure I have a USB drive thingy with anywhere NEAR as much space as I’d need…

[u/vanIvan4 → u/Puzzleheaded-Bar1464]

Any tech shop will usually provide those services. Though you still need to change passwords on everything that your PC interacted with while they would work on it, since whoever gain access probably stole your login data.

[u/Puzzleheaded-Bar1464 → u/vanIvan4]

Changing passwords now, thank you

[u/Legitimate-Drama-254 → u/Puzzleheaded-Bar1464]

NOT on the infected pc

[u/xNekomaiShinxX → u/Puzzleheaded-Bar1464]

yup, gotta change the passwords from ur phone or a different pc

[u/Successful-Height152 → u/Puzzleheaded-Bar1464]

Do not change passwords on infected device

[u/Programmer_Worldly → u/Puzzleheaded-Bar1464]

Are you actively ragebaiting?

[u/throwedthaway → u/Programmer_Worldly]

redditors when someone doesnt have the same amount of technical prowess as them: DOWNVOTE!!!!!

[u/No-Communication9458 → u/Puzzleheaded-Bar1464]

....

[u/computerviruses-ModTeam → u/[deleted]]

Your post was removed because it is a personal attack on someone else or a group of users. Please be civilized. Please make sure to read and follow https://www.reddit.com/r/computerviruses/about/rules

[u/Puzzleheaded-Bar1464 → u/[deleted]]

Not a Karen, just a genuinely shocked and frightened 27 yr old girl who has been an apparently very sheltered when it comes to these things - thank you for defending my honor!!!! You’re a good egg

[u/dankhimself → u/[deleted]]

Eh, maybe it was dark out or far away in this imaginary scenario.

I don't have a problem wirh OP at all. It was just a funny analogy that is quite similar.

Why are you commenting to actually be insulting and then consider whether or not the poster is a Karen?

The correct advice was given before I was here and and I upvoted them for visibility.

If anyone is acting like a Karen, well...

[u/dankhimself → u/[deleted]]

You should be a decent person and upvote relevant information for visibility purposes when people need help. It's called reddiquette.

Short analogies are conversational, sometimes a little vague, but they convey the point, and you can do the rest yourself, laugh/don't, and move on.

I'm sorry, the manager isn't in today.

[u/dankhimself → u/[deleted]]

I was glad OP got the helpful information they needed here so quickly, so I decided it was ok to reflect upon the situation with humor. If you worked in service, you'd understand.

Sorry I offended you, but I stand by my suboptimal analogy. And I prefer it over overexplanation, which, you can see from this exchange, reduces it's comedic impact. But, you've done it, you've successfully turned a giggle into a groan, you've gotten your store credit, and a coupon for 10% off your next purchase.

[u/PossibleSoftware3247 → u/dankhimself]

Don’t apologize for offending them.

They chose to be offended, because yes, being offended is a choice.

It’s not your job to accommodate them, it’s their job to grow a thick skin and learn to be unbothered, period.

I didn’t bother reading the full comment, yet I instinctively know that they’re most probably accusing you of gaslighting.

[u/DSkedda]

Usually most Laptops have a button combination to turn of wifi, do that to at least get rid of remote access (if you can) otherwise unplug your router. Then look up guides to get rid of malware etc. Run malwarebytes for example. Best is if you reinstall windows entirely.

[u/axehyle → u/[deleted]]

RAT, not infostealer. the attacker could steal the victim's credentials but it doesn't make that virus an infostealer.

[u/Sapthepro → u/[deleted]]

Info stealer?????

[u/Sapthepro → u/[deleted]]

It's literally shown as a rat not an info stealer bro

[u/viciousmagpie23 → u/[deleted]]

even with my limited knowledge about all this stuff, rat =/= inforstealer

[u/IKaizoku]

The best part for me is, when she just watches someone maliciously controlling her laptop - "omg this is so invasive". How can you be so chill?

I would go full panic mode and either smash my PC or turn the power switch down for the whole appartment haha

[u/_myweedaccount_]

Erase All the data on your computer and stop asking questions why

[u/_myweedaccount_ → u/[deleted]]

I meant wipe now, ask questions later. Why watch someone just control your pc and let it happen lol

[u/_myweedaccount_ → u/[deleted]]

That’s what I just said, yes, lol

[u/CycloneJester → u/[deleted]]

Yes, but he admitted that's not what he meant, and clarified what he meant. What's the issue with that?

[u/_myweedaccount_ → u/[deleted]]

This thread is so funny. I clarified what I meant, nor is it that deep

[u/CycloneJester → u/_myweedaccount_]

I know, I know...It's just such a bad-faith argument. Like, did he really think you meant OP shouldn't address the issue first? Why would you be saying, "reset the PC and then never learn more about what happened"

[u/CycloneJester → u/[deleted]]

Honestly, what he meant was obvious. If someone's house is on fire, and someone is standing there asking what's happening, you tell them to shut up, and get out of the house.

Obviously that doesn't mean that they shouldn't want to know the cause of the fire, or that they shouldn't take precautions in the future to prevent fires. It means that the situation is severe.

You taking it as the way you did is understandable. But once he clearlt clarified what he meant you doubled down for no real reason.

The issue is nothing more than you being pedantic lmao

[u/Alarming-Try4262 → u/_myweedaccount_]

No you said stop asking why. Not ask later.

[u/CycloneJester → u/Alarming-Try4262]

He admitted he miswrote what he meant.

[u/CycloneJester → u/[deleted]]

He said A.

You said A is wrong.

He said I meant B

You said, so you should have wrote B.

He said, yes, that is what I said.

He admitted he should have wrote B. You're so far up your own ass about this you're swinging at nothing.

[u/MegStuff]

Wipe. The. Computer. As. Soon. As. Possible.

[u/Agreeable-Match2908 → u/MegStuff]

WTCASAP

[u/Potential_Kick540 → u/Agreeable-Match2908]

NTS (Nuke that shit)

[u/gianpi612 → u/Potential_Kick540]

NTFS (Nuke that fucking shit)

[u/Famous_Ostrich_2702 → u/MegStuff]

They vacuumed cookies, passwords, and personal info. It literally takes less than 1 min to do that. Wiping the computer is only the very first step in a list of steps OP needs to take.

[u/Some-Panic8915]

disconnect from the internet (if on wifi turn off auto connect)

Run a full scan on windowns defender

You probably have a script installed that is trying to download something from somewhere.

In the future use firefox/brave with ublock origin.

[u/XXPhobia]

Why is everyone so mad wtf??? Just help the poor girl

[u/Beefwithdudes]

If you have a backup computer get a usb drive, plug it into the backup pc, put livecd Linux on it, plug it into ur main pc (in the boot menu select the usb) and back up your shit. Then prob wipe your hard drive

[u/Potential_Kick540]

Bro nuke that fucking pc and every other device connected to your house network

[u/Evening_Werewolf_703]

I am going to take it to a tech store to ensure the issue is resolved effectively, as this is clearly more than I am prepared to handle on my own.

Good. This is what you should do. Your photos will likely be saved, but everything else will probably be wiped as the best course of action is what's known as a "reformat." -- Basically, wiping the drive and doing a fresh install of Windows 11. You can do this yourself if need be; it'll be easy to find a tutorial to re-install Windows on YouTube, but I'll try to give you some suggestions.

1. Get an anti-virus program / subscription like Bit Defender or Norton. Avoid McAfee anti-virus at all costs. McAfee comes bundled with other things or a discount (etc) but uses unethical scare tactics to pressure people into subscriptions. It's also generally almost considered malicious itself for how difficult it is to remove. Generally, AV (anti-virus) run in the background and scan when you're not using your laptop, leaving a review screen for you later. The same for program and definition (virus dictionary/reference) lists. It's best to be very deliberate about the choice of important software.

2. You'll most likely want to do a scan of something like Malwarebytes Anti-Malware or Super AntiSpyware (tracking cookies can slow a PC down to a crawl) every so often. You just install them, run the scan, clean your computer and uninstall them (add/remove programs). I am not joking about tracking cookies -- they're gross and both invasive and performance taxing, much more than you would otherwise think -- especially for less powerful systems.

3. Be very careful with modern installers; many will try to install all sorts of stuff. They try to take advantage of people that just click "Next, Next, Next" without reading. The worst of them, from unsavory developers, will install stuff despite being declined. Don't rush your way through an installer; make sure to read and make sure that you're not installing additional software like McAfee or a Toolbar -- many of the things that you can install can be leveraged by other malicious software to break into your system.

4. AdBlockers are ESSENTIAL on the modern internet. They're typically known as "extensions." I wouldn't recommend Chrome, as Google has been weakening AdBlockers this past year, but they don't exercise enough control over their "ads." [Firefox] is a safe bet with [uBlock Origin.] You can consider using other extensions like Privacy Badger or NoScript, but generally, having a strong ad-blocker on your PC is 10/10 mandatory. It's what 99% of us do when troubleshooting family/relative's PCs.

5. NEVER ENABLE WEBSITE NOTIFICATIONS; they can serve you all sorts of malicious or confusing stuff. This is one of those features where the best of intentions met the worst of humanity. At best they're obtrusive and annoying at worst they're malicious and will get you to try to install some sort of small, innocuous looking executable, .exe file. Clicking on anything other than the X (and they can try to mislead you with a "fake" X that's just part of a picture) could potentially download a small executable (which is why it's best to just not mess with website notifications at all).

6. That's where something like Bit Defender or Norton will help; paid subscriptions will scan everything you download and monitor your in-bound and out-bound connections (whether someone potentially malicious is trying to connect). AV software and subscriptions are expensive, but the amount of time, stress and anxiety they save the average more tech illiterate person is indisputable.

[u/Dapper-Comment-682]

unplug the ethernet cable or disconnect from the wifi is your 1st step

[u/Silent_Chemistry8576]

Unplug internet and begin the process of nuking your OS. Reinstall and disable/uninstall windows remote access app. They have this on the windows install I've found it on multiple family members pcs after fresh installs using different usbs and ISOs I created with the windows app and Rufus. Sorry OP you may lose data if they installed any lingering malware.

[u/K0EDA]

too focused on the fly at the start of the video

[u/Puzzleheaded-Bar1464 → u/K0EDA]

So close! That’s actually some kind of glare/damage on my phone’s camera lens that shows up in most of my videos.

[u/K0EDA → u/Puzzleheaded-Bar1464]

phone's haunted.

[u/5yn3rgy]

Man, I didn’t realize this group was full of so many snobs and AH’s. Op asked for help in a group specifically for things like this. If you can’t be nice and helpful keep scrolling.

[u/thr0wethawayeth]

why are you just watching them control your pc turn it off lmao some people man

[u/LittlexLostxNexuZ]

Mmmm, you are indeed fundamentally screwed. Go ahead and reset Windows from a USB and reset all your passwords. There’s really no hope otherwise. If you didn’t back up your things, it’s pretty much over. But next time, although this won’t fully protect you from infostealers if you run them yourself, pick up an antivirus. I’m fond of Avast, but I know others aren’t, so just pick up Bitdefender. Also, use Brave with uBlock Origin. And honestly, a bit of computer literacy would go a long way, if your gonna have large aspects of your life in the digital realm, you should aggressively inform yourself on the dangers online and how to protect yourself.

[u/InkyGhoul]

Buddy it's time to factory reset your puter and reinstall windows completely fresh from a different usb to your mother board

[u/Glittering_Milk359]

First disable Internet second fresh install os, would not recommend saving files because if your dealing with hackers this will leave backdoors and you end up in same boat

[u/Famous_Ostrich_2702]

If this is a serious video then you need to do more than just wipe your computer.

You need to change your passwords and use accounts "log out everywhere" function.

In the time of that video the person could have grabbed all your session cookies (so wouldn't even need a password or 2FA). If your passwords were stored in your browser, they got those too.

If any personal pictures were sexual, then be on the look out for future blackmail scams. Blackmail scams are the hot thing in scammer world and they will try to hit you up, your family, and your employer.

[u/huttobe]

While erasing etc be sure to set up a wireshark or some kind of traffic sniffer to get the ip that this thing is connecting. Then you will have some leverage against them when they mail you for blackmail etc. so they can fear and not deal with you anymore.

[u/joeyroxas]

Good practice of you, you did the right things, disconnecting your device from the internet, and changing all of your accounts passwords from a different device that isnt infected, you not being tech-savvy doesnt mean your dumb, so let the haters hate, in fact, i feel like many people in this case wouldnt even think about disconnecting and changing passwords from a different device, you knowing this is putting you on the road of being tech-savvy

[u/AutoModerator]

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

1. From a different and clean device, change all your passwords:
   • How to properly secure my accounts after an infostealer attack?
2. Disinfect your device from malware
   • Preferred method: Perform a clean installation with a USB

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/computerviruses-ModTeam → u/[deleted]]

Your post was removed because it is a personal attack on someone else or a group of users. Please be civilized. Please make sure to read and follow https://www.reddit.com/r/computerviruses/about/rules

[u/M1uk0]

You really need to reinstall windows on this device... make sure to download windows on a seperate clean device and keep it in a usb, so that the RAT won't follow into the next system you downloaded. And make sure to do a clean wipe of your device first too! But why is everyone being so rude to them? They're very new to this and needed to ask for help... Anyways, do you have any good Antiviruses? Like Bitdefender, Malwarebytes, etc...? It would help prevent stuff like this in the future if you install them, since malware can easily overwrite windows defender and allow it to not detect anything.

[u/Memerenok]

thats why we burn windows installer usbs ahead of time, for situations like this

[u/pedidosdeavon15]

What happened in the end, were you able to solve it?

[u/meletiondreams]

You installed an rat and infostealer.

If you'd like to wipe properly here's how, otherwise take it to Best Buy and ask them to remove all viruses Warning: I am not responsible for you messing up, or something, and everything you do here is on you. I am not responsible for your computer.

Disconnect from internet via your computer.

Transfer needed files to another usb or hard drive, do NOT transfer these file types: exe scr bat vbs, and ANYTHING you don't recognize, don't transfer browsers.

Then, shutdown your PC, and reset all your passwords, on a different device from your PC. Do NOT boot back into your PC.

Then, on a seperate computer (could be a friend's PC, or something) download the windows 11 iso (https://www.microsoft.com/en-au/software-download/windows11), or use their install media to install it to an external usb. This USB will be wiped. (lookup how to flash an iso if you have to)

Next, plug the usb into your PC and get to your bootloader, depending on your PC it might be a different key you have to click when launching; refer to google, or to your manual if you have one, usually you can just google "[PC Model or motherboard] boot key".

This is a bit foggy now since I don't know your exact bios, you can search for "boot order" and move the usb to the top. Click save or exit, and boot.

Walk through the windows install making sure to delete all the partitons to be safe.

After install run malwarebytes just to be safe.

[u/Rxmanus]

RAT is creepy lxl

[u/shayel98]

Windows defender incompetency should be talked about..at least people should use bitdefender free or some solution

[u/arschpLatz → u/shayel98]

Windows defender isn't the Problem here. Op is a problem, users like u/Pure_Software3661 and you are the problem. Wtf are you doing and talking about???

[u/shayel98 → u/arschpLatz]

Do you pirate stuff?..I do...once i got adwares, malwares and infostealer from dodi repacks....i keep bitdefender and bitdefender is lot more competent than defender

[u/Pure_Software3661 → u/arschpLatz]

Want this happens to me all the time when it was updating files that exact thing happens to my computer when my USB Wi-Fi antenna gets it automatic update that only started happening when I got a new one

[u/Famous_Ostrich_2702 → u/shayel98]

The user had to have had multiple windows user access control prompts pop up before access like this can happen. They clicked Yes on every single one.

Windows defender is not the issue here. Bitdefender would have had the same results.

[u/Puzzleheaded-Bar1464 → u/Famous_Ostrich_2702]

Hi this is false because no prompts of any such thing have ever popped up, try again xoxo

[u/Famous_Ostrich_2702 → u/Puzzleheaded-Bar1464]

Yes, they did. It could have happened days before the video. Any "fixes" you did for the "yahoo redirect virus" would require system level fixes since ya know that malware lives at the system level.

Sorry that you are completely unaware of how these machines work and your first instinct with new information is to get defensive.

[u/Gin-N-Rum-5454]

Hey don't give flak for those calling you an idiot. You don't need to know anything about computers to detect a scam, that's if you use your brain :)

[u/gianpi612 → u/[deleted]]

That "browser updating" window doesn't exist even if the problem was somehow the keyboard

[u/Puzzleheaded-Bar1464 → u/[deleted]]

What’s “Gys” and look dude, in my 27 years alive I have never ever experienced this, nor have I ever experienced anything that would inspire me to learn that I might need that stuff you mentioned. Just be kind or shut up

[u/Best-Draft-468 → u/Puzzleheaded-Bar1464]

I mean there is a nice way of saying something absolutely, but in an age where 98% of school, work, and social tasks are in a digital environment reliant in computers in some way shape or form, absolute basic upon basic of computer literacy should be a requirement. Many basic concepts employed in day to day and simple precautions can circumvent most of not all instances of being compromised.

The goal is to learn and improve, not fix it for you and never learn or care to learn the why, how, or when just for it to reoccur again and again and again over and over at 30,40,50,60 or even 70 when stakes are much higher and recovery significantly more difficult.

With that being said, the advice here is the best. Disconnect, save any core information that isn't tied to its operating system or files, download a clean installation media from a separate computer (do not rely on backups or restores), wipe the drive completely via reformating and best to reformat twice (there's a technical reason for this) and then reinstall from the installation media that came from a secure and different computer. Look into basic easy entry level measures such as a more secure browser, adware blocks such as ublock origin, and combine it with a light and free VPN when dealing with unknown or sketchy websites.

Super basic yet effective for 80% of issues.

More could be done yes, but for you I would imagine it's not needed as you don't seem to be doing anything that would require it.

All in all you'll get through and make it out the other side alright so don't sweat it too much but definitely learn from it

[u/Krauziak90 → u/[deleted]]

I use malwarebytes for good idk 8 years. It detects apps which are not even opened, they have their own blacklists which are updated constantly + will warn you about any sketchy connection inbound or outbound. in browser thing will warn you about suspicious website from the browser level. I'm not saying it's perfect, as is not, but better have it than not

[u/Pure_Software3661]

It's not a virus I have that on mine the only started happening when my USB Internet antenna was updating its files automatically it does that just keep closing them out when the files finished updating it will go back to your normal one and if you got a letter or text message about your Wi-Fi router being no longer supported by your internet provider you need to get a new one it will also help