NorCalDaveG Posted April 16, 2019 ID:1308041 Share Posted April 16, 2019 I screwed up yesterday and opened a hack inserted from an email. Very professional and from a close business associate. Was in a hurry and didn't look at the email address behind the name. So, when it started, I ran Malwarebytes and it found two Trojan.Q bot files. quarantined. Closed computer and restarted. I noticed a C prompt window for the Powershell.exe and it flashed a red entry and closed. I ran Malwarebytes again and it found 4 files. Quarantined. My computer is hacked for sure. I am pretty sure they have remote control, since I get a message that Microsoft Management Console isn't closed when I shut down the computer. I have lost access to all of the USB ports and cannot find anyway to restart them. I have lost my recent restore points. At this point I have disconnected the computer from the internet router and have copied the main files that I NEED for the business. I was getting ready to just reformat the C drive and install a new windows 10, but I read an earlier forum where someone sounded like they had close to or the same issue. It was pretty intense and complicated, but sounded like you were able to restore the computer without the hackers still having control. I am afraid to open anything online, since I am pretty sure they are grabbing anything they can and I am hoping I caught this quick enough. But, it is pretty likely they have been able to copy files from my computer, at least that is what I am thinking. Would it be best to just take the hit, which is massive since this is a computer I use for a home based business, and do a clean install of a new OS? I will lose a lot, but I will pay that price to get my computer back. Is it likely they have accessed all of the hard drives on the computer also? I have 3 different hard drives. Even when I restart the computer now, without the internet connected, the Powershell.exe C: prompt opens and flashes the red command before closing. I am guessing that means they are running the computer? Not a clue where to go next other than to do a clean install and take the hit for my stupidity. Link to post Share on other sites More sharing options...
NorCalDaveG Posted April 16, 2019 Author ID:1308042 Share Posted April 16, 2019 OH, I am sending this from a laptop that I am using during this problem. Link to post Share on other sites More sharing options...
nasdaq Posted April 17, 2019 ID:1308193 Share Posted April 17, 2019 Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Boot the computer in Safe Mode with Newtorking.https://support.microsoft.com/en-ca/help/12376/windows-10-start-your-pc-in-safe-mode Download the Farbar Recovery Scan Tool (FRST).Choose the 32 or 64 bit version for your system. and save it to a folder on your computer's Desktop. Double-click to run it. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. How to attach a file to your reply: In the Reply section in the bottom of the topic Click the "more reply Options" button. Attach the file. Select the "Choose a File" navigate to the location of the File.Click the file you wish to Attach.Click Attach this file.Click the Add reply button. === Please post the logs for my review. Wait for further instructions --- Or you can download the Farbar program using the other computer. Open the Windows 10 computer in Safe Mode only. Copy the the Farbar program to the Desktop of the compromised computer and run it from there. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 19, 2019 Root Admin ID:1308749 Share Posted April 19, 2019 Are you still with us @NorCalDaveG Link to post Share on other sites More sharing options...
NorCalDaveG Posted April 20, 2019 Author ID:1308770 Share Posted April 20, 2019 I am back. I really do apologize. I threw in the towel. A lot of reasons, but it felt like I just needed to start anew. I removed the old hard drives, installed two new ones, installed a new clean Windows 10 Pro OS, new programs and threw away the old hard drives. Lost a bit, but I felt like I had been raped, so just closing the door and beginning completely new felt right. Malwarebytes is my GO TO. Back running now. Thanks again. I hope i don't have to come back here again. Going to be a whole lot more watchful and careful. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 20, 2019 Root Admin ID:1308774 Share Posted April 20, 2019 Okay, sorry to hear but glad you're back up and running well again. Please review the information below and don't forget about backups so that you don't lose your data. https://www.bleepingcomputer.com/forums/t/684202/best-backup-software-for-windows-10/page-3#entry4769030 Help Secure your browsers Please install uBlock Origin for your browsers to better protect your system FireFox, Chrome, Opera , Safari, Microsoft EdgeAdBlock for Internet Explorer Follow-up Reading Everything you need to know about cybercrime 10 easy ways to prevent malware infection Keep your data backed up Thank you for choosing Malwarebytes Ron Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 25, 2019 Root Admin ID:1309485 Share Posted April 25, 2019 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts