Someone remote-desktop'd into my PC. Now three new accounts have appeared.

[Shally]

So during the week I was playing a CS:GO game with friends when my screen turned blue and it told me someone was attempting to remote desktop into my computer. Being in the heat of the moment in CS:GO I thought a application was requesting permission so I clicked accept, and immediately realized what I had done. I turned off my PC instantly as I windows wasn't responding to me anymore.

 

The user that did this had a windows name as windowsuac. Now that's very close to Windows UAC, User Access Control. But when I google windowUAC altogether I get no results. Now when turning on my PC this morning I noticed three new accounts had been created on my machine, sub, admins, and windowsuac.

 

They all had Administrator powers, which I removed immediately. I never made these accounts.

So, is Windows being strange and doing all this itself or should I be worried something has entered my System? 

[WereCatf]

1 minute ago, Shally said:

So, is Windows being strange and doing all this itself

No, Windows doesn't just randomly ask for remote-desktop permissions and start creating new accounts.

[Shally]

1 minute ago, WereCatf said:

No, Windows doesn't just randomly ask for remote-desktop permissions and start creating new accounts.

I'm thinking of doing a fresh install of Windows, would you agree?

[jaslion]

3 minutes ago, Shally said:

So during the week I was playing a CS:GO game with friends when my screen turned blue and it told me someone was attempting to remote desktop into my computer. Being in the heat of the moment in CS:GO I thought a application was requesting permission so I clicked accept, and immediately realized what I had done. I turned off my PC instantly as I windows wasn't responding to me anymore.

 

The user that did this had a windows name as windowsuac. Now that's very close to Windows UAC, User Access Control. But when I google windowUAC altogether I get no results. Now when turning on my PC this morning I noticed three new accounts had been created on my machine, sub, admins, and windowsuac.

 

They all had Administrator powers, which I removed immediately. I never made these accounts.

So, is Windows being strange and doing all this itself or should I be worried something has entered my System? 

I'd say start with scanning with malwarebytes. You probably have been infected by something.

[WereCatf]

Just now, Shally said:

I'm thinking of doing a fresh install of Windows, would you agree?

I would do a fresh install, so yes.

[jaslion]

Just now, Shally said:

I'm thinking of doing a fresh install of Windows, would you agree?

That is also a very good idea and then on another device or the fresh install start making new passwords on all your accounts.

[ARikozuM]

Download Kaspersky Rescue Disk. It's an OS that will run without any of your Windows stuff up and running. Run the scan first. 

Then boot into safe mode (w/o networking!) and delete those accounts from your PC. 

[Shally]

Just now, ARikozuM said:

Download Kaspersky Rescue Disk. It's an OS that will run without any of your Windows stuff up and running. Run the scan first. 

Then boot into safe mode (w/o networking!) and delete those accounts from your PC. 

What's the scan do?

[Anus_McSphincter]

Fresh install is the way to go... and set a stronger password.

[Shally]

3 minutes ago, jaslion said:

I'd say start with scanning with malwarebytes. You probably have been infected by something.

I ran it there, I just got a lot of pup's, nothing too concrete

[Tristerin]

Yea fresh install, all PWs reset - Ive done some newb stuff but allowing remote viewing in the heat of the moment isn't one of them.  

 

Im honestly perplexed how one would do this.  Ive never used, so just checked, the interface of Windows remove viewing App - it looks nothing like UAC or allowing stuff through internet prompt. 

 

Must have been one hell of a competitive match.

[ARikozuM]

1 minute ago, Shally said:

What's the scan do?

Checks everything on the disk before it has a chance to hide.

[EL02]

Just do a fresh install just to be extra safe.

[Shally]

7 minutes ago, Tristerin said:

Yea fresh install, all PWs reset - Ive done some newb stuff but allowing remote viewing in the heat of the moment isn't one of them.  

 

Im honestly perplexed how one would do this.  Ive never used, so just checked, the interface of Windows remove viewing App - it looks nothing like UAC or allowing stuff through internet prompt. 

 

Must have been one hell of a competitive match.

Is a fresh install the same as Windows reset?

[Tristerin]

8 minutes ago, Shally said:

Is a fresh install the same as Windows reset?

Ive never used Windows Reset, I only fresh install when I get myself too deep into the viral portions of the interwebs.  Im not sure if Windows Reset is a clean set of directories, root access etc whereas a fresh install (need the ISO or recovery media to do this) is

 

I only recommend fresh installs and all PWs changed because that's what I would do in this situation.

[nick name]

This is why I never rush B.  

[Wh0_Am_1]

17 minutes ago, Shally said:

Is a fresh install the same as Windows reset?

Do note (this is probably very obvious but I am going to say it anyway just in case) the first thing you should do before any of this is you are going to want to disconnect from the internet before you turn your PC back on, thereby preventing the perpetrator from accessing your data or causing further damage.

[vanished]

4 hours ago, Shally said:

I'm thinking of doing a fresh install of Windows, would you agree?

I would do a fresh install, followed by changing all of the passwords to all of your accounts, as well as all of your network credentials (wifi password, admin password for the router, etc.).  This is because (clearly) they were able to get in, and thus know how, and thus a change is necessary to prevent that from immediately happening again, plus the fact that you don't know what other credentials may have been stolen while they were connected.

 

I would then have a thorough look through the router settings to see if anything could be tightened.  No port forwarding, no UPnP, etc.  This is key - never mind that it asked and that you clicked accept when you could/should have clicked deny - it should not have been possible for someone to even make it prompt you in the first place.  By the time that happened your security had already failed.

 

Finally, assuming you don't use remote desktop yourself, I would disable it in Windows.  Never hurts to have an extra little bit of protection, if not against others, at least against yourself