Once you have done that, reset your firewall to an implicit-deny and then methodically open only the ports that you need. Once you are satisfied with tat, reinstall one of those scanners. If you do not want to go to that extreme, use several third party virus/malware scanners on USB drives to sweep the system. Of course also, monitor any account that you may have accessed and change all your passwords. Is looking through the running Processes list good enough? If so, would such a program be running under my username, LOCAL, or could it be listed as a service or SYSTEM?Īlso, since I would in theory like to be able to use RDP again in the future, does anyone have any tips for making it more secure? No idea how this hacker was able to log in via my remote desktop, but looks like he logged in several times over the last 5 days.Īs someone who routinely investigates and re-mediates network intrusions I can easily say, the most secure solution is to wipe your system - switch out the drive (or at least use a forensic wiper) and start over. Just wondering if there are ways to be at least reasonably sure that there are no backdoors on my machine. I am very busy right now and this would be an _IMMENSE_ pain, but I will do it if it is the only intelligent solution. In light of that, seems like the smart/safe thing to do would be to reinstall Windows and whipe everything. But now worried that with unrestricted access to my machine they installed a keylogger or something. I turned off remote desktop and un-DMZed my connection.

Took me over a day or so to figure out exactly what happened after I noticed fradulent purchases from my eBay and Paypal and text message sent remotely from my phone (via Pushbullet app), but determined from talking to eBay (and finding out the orders were made from my IP address) and then checking my browser history and finally system logs that the culprit was a Russian logging into my Remote Desktop via a proxy.

Teamviewer hacked 2017