Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Computer Hacked, Then Hijacked [Closed]


  • This topic is locked This topic is locked

#1
traveler818

traveler818

    Member

  • Member
  • PipPipPip
  • 140 posts
Please help before it's too late. I have a 1-yr-old Toshiba Satellite Pro L750 series laptop (never again!). It arrived with problems but Toshiba refused, even brand new, to replace it. That (& major overload) led to me make a mistake that got my computer hacked, but it was months before I figured it out and will need to deal with the fallout from that later, but first the computer. The hacker installed all kinds of malware (hid it everywhere) and every toolbar ever made--I don't know what I am dealing with now. I have a couple of screenshots, but the problems are much bigger than what I can capture that way. Before that, the hacker ultimately made the computer unbootable. I could not get online to load updates or drivers. I listed all the issues I can remember in the last paragraph, but until i have full control, I can only say what happens when i try to read a website or type an email.

I am poor, disabled (terminal), and isolated--I need cancer care & much more--I will be living on the streets and need all the resources I can find--this is my tool for that and more. I called local churches for help and got 2 volunteers.

One took the computer apart, then reinstalled the os, but it was/is still having all kinds of problems. They say they owned a shop but either they were not good at it, or the computer was left this way so the rest of their plan (to convert me to their "religion") could be completed. The other volunteer took over to complete repairs--but mostly doesn't show up. The first thing she did was remove my administrator account, set herself up as sys admin and blocked me with a password. My password reset disk won't work. I can do this and email, nothing more.

I thought when she was here she was working on the computer. Then one day, I caught her quietly loading music. I figured it was to celebrate a finished repair. No. It was hours of Mormon music--I am not impressed with such tactics and I dont want it. I have been too isolated to get cancer care, which is 500 miles away. While living in a van, the computer is my resource for safe shelter, food--everything. Having outlived 5 doctors by 3 years now, time is of the essence and I am really suffering. Meanwhile, she is clearly planning to hold the computer ransom until she feels my soul is hers to control. I hope this is the right place to post this. If I can get my computer back, I will run the malware cleaning guide, and protect my computer acc to your instructions. I tried before, but the hacker disabled this site ASAP.

I can come up with enough to buy mbam at least. I also use WOT in my own way. The Mormon didn't like it, so she disabled that too. This is infuriating.

Meanwhile, she insists I run the free version of AVG. Just in passing, during 2 scans, I saw it pass 2 pieces of malware (mywebsearch, and Cascale Media--this was long ago--I don't recall why it is on my malware list, but i had a reason) onto the computer--they are in here and I cannot download to get them out--once mywebsearch gets on your computer, it keeps coming back and hiding. The malware has had weeks now to do whatever it does. Google blocked something too.

Months ago, I intended to run the spyware & cleaning guide and go from there. I just had to be able to get in. The hadcker made access impossible so I needed to be able to get back in, which is how I got into this mess. I was asleep sick all week or I would have contacted you sooner. She changed the wallpaper to a child's. She disabled remote access. I can only hope that is why the computer hasn't updated in a few weeks--she says that is normal. That and drivers were the main issue before, and she is supposedly going to load drivers on Monday, but her last words were that she would return to load more Mormon music. This woman is going to kill me in the process of saving my soul, and it is getting urgent as I cannot afford heat in the winter. Can you help?

She knows about this site and I fear she will block me here too. I am out of time, and she finds it amusing. Worse, she is clearly having so much fun seeing me so distressed (she has a foolproof plan to convert me, and the computer is her weapon--if I want it back, I become a Mormon. Unless I can get control. Her disregard for my health could do a LOT of harm--I am running out of time fast).

I need to get into my computer and work with you. I did once a long time ago, but my computer died and I was unable to get out to contact you--this is my second nightmare machine. I also had the privilege to work with Spysentinel. He was wonderful. I know he is not here any more. :(. I will always remember him--kindness like his is rare.

Here is a list of issues I remember now--my hope was that if I ran the cleaning guide, the list would get shorter; text is constantly deleted, the size of the text changes every half hour on a good day, usually more often, and gets super tiny (a full page can become a strip 1/2" wide by 3" long). I keep setting it, but all in all, this computer seems to disregard settings and does as it pleases.

MSN pops up every 15 minutes, pages scroll up, sometimes I lose my work, it freezes, things turn blue, the cursor goes where it wants to and deletes everything until I find it. Drivers were not loading which is how this started, nor were updates as I could not get online. Pages send themselves. Sometimes they spin in a dizzying circle first. Most emails have to be typed 2-5 times, not counting those that are only partially deleted--I save compulsively now, but even that doesn't always protect my text. Page borders change. Frequently, it can take ten minutes for a page to load. Startup is super slow. Most of my features have been disabled--webcam, Skype, face recognition, anything that needs to be downloaded. It reads CD's if it is in the mood. I know there is more, some of which I won't see until I have my control back. Pages cease to exist. Google actually blocked something--nothing controversial. The screenshots show a couple of other strange behaviors. Emails disappear. Almost nothing works right to sum it up. If I can get back online, i may have more information-this is from memory at 4:30 am. Help.
  • 0

Advertisements


#2
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi there, first thing we need to determine is, is there anything on the computer that you cannot afford to lose ?

What I would be looking at here is to get you to restore the computer back to factory settings and then make it as secure as possible.

Is that something you would be agreeable to ?
Or would you like to attempt a clean up ?

Details on how to restore to factory settings are here
  • 0

#3
traveler818

traveler818

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 140 posts
Thank you for the rapid response. I suspect a cleanup would take a long time and a lot of work. In which case, all I really want is one really important email. I like the idea of restoring it to factory settings, and making it more secure. I do not have a printer, and the library is closed until Tuesday. I can print out the email, and will get started with the instructions you gave me. Thank you again. :thumbsup: I will keep you posted. You all are the best.

Edited by traveler818, 28 October 2012 - 12:29 AM.

  • 0

#4
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Not a problem, as soon as you have restored the computer, keep it safe from prying hands. Then download and run the following programme so that we can see what is and is not required, to give you a nice lean and clean machine.

After that I will assist you in making it as secure as possible

Download OTL to your Desktop

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

    Posted Image
  • Select All Users
  • Under the Custom Scan box paste this in

    netsvcs
    BASESERVICES
    %SYSTEMDRIVE%\*.exe
    CREATERESTOREPOINT

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Post both logs

  • 0

#5
traveler818

traveler818

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 140 posts
I finally got going, and saw that the instructions were simple and clear, but..out of at least 12 tries, I was only able to get to the window with Repair My Computer 3 times. The Toshiba logo appears for maybe 15 seconds so I tried several times, with my finger ready to push F8. I then tried holding F8 down from the moment I started the computer. Then, I tried tapping F8 repeatedly. I got the window 3 times, but don't recall how--I have done that before but it was not so hard.

Getting in gets me nowhere because the fanatic, besides making herself the sys admin gave the computer 3 different spellings of my name (and counting), in different places--she added an s to the computer's name, and changed the a at the end of mine to an e. After her husband did a complete reinstall, I should have had a working computer--this has all been deliberate. My login has the a at the end, as it should be, currently with no password. She renamed the computer by adding an s to the end of it's name.

When I got to "System Recovery Options," my only option was Startup Repair. I find 3 users--one is just a word; one is HomeGroupUser$; and one is my name but with the e at the end. The computer knows me with the a, which is still my logon name. I tried to change the spelling, but can't edit that page to change the e to a. I tried to create a user account with the a at the end, but cannot add a user without administrator privileges.

She knew how to sabotage me assured that she was my only source for help--I believe she did not let me download the driver license renewal because she knew I was poor, and this trip cost me over $100.00. The less money I had, the more I would have to rely on her, thus making me easier to convert. If nothing else, I deserve credit for not saying what I want to say. I am furious.

Why is it so hard to get to Boot Options versus Windows (which takes forever to load just to shut it off and try again), this has consumed hours and got me nowhere (but my back is killing me). I get that window periodically saying my Windows session did not complete successfully. So I tried twice to do an incomplete procedure but my guess is just typing isn't enough so I tried to make my "security" software do something and shut down before it was done, but that didn't work either.

So far,it is so simple, clearly she knew every way in and blocked them all. Now what? The computer has no idea who is trying to make changes. I suspect, but am not sure, that if I can create an account with my name the way the computer knows it, I may get the whole recovery options page, but I cannot without administrator permissions. I have never had so much trouble with the F8 procedure.

If I didn't know this was deliberate, I would be embarrassed. What now?

BTW, it will be several months, less if possible, I think I should enroll in GeekU. I will look into it when the time comes. I am tired of fighting in the dark.

Edited by traveler818, 05 November 2012 - 12:51 AM.

  • 0

#6
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
OK there is another way around this, I assume you have windows 7 ?
I can give you a Digital River download link for a legal MS ISO disc for windows 7. You will need to have your windows key for this to work, it should be on a sticker on the side of your computer.
With this you can totally wipe the system and start again from scratch

If we go this route we can create the disc for use as many times as you wish on that computer ..


Let me know if you wish to do this
  • 0

#7
traveler818

traveler818

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 140 posts
I was ready to post my reply and it was all erased--I am working with a flashlight and magnifying glass (old eyes--so I have to do it again). YES, I want to do this procedure, and yes I am running Windows 7. (I don't know if this is relevant but the modem still thinks it is a Gateway running Vista.)

I found no sticker on the sides of the computer, but I did find one on the bottom. To be sure, I gave you all it said so here goes again line by line as it is on the sticker:

At the top, the sticker says:

Windows7 Home Prem OA
TOSHIBA
bar code G66C0002GC10

Then:

If I am blocked from downloading, will the disc work? The CD drive usually doesn't work. It either tells me the disc is empty (including the green discs and the password reset disc). It seems to read the computer repair disc but all that does is log me into Windows so I cannot be sure from where I am booting. Sometimes, I hear the CD drive working but that, in no way, guarantees success.

Sometimes, the message I get most is "Please insert a CD in the drive". I take it out and put it back in but this just keeps repeating. Also,if I insert a CD in drive D, the computer calls it drive E--this doesn't happen every time, but more often than not. Changing it back to D does not work. If I then insert a flash drive, that becomes drive F. So it skips drive D. At this point, that is usually the end as it keeps telling me to insert a CD in the drive and I do, but it just gives the same message.

I just inserted a music disc and it is playing just fine (?)

Edited by Essexboy, 06 November 2012 - 07:56 AM.

  • 0

#8
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
http://msft.digitalr...n/X17-58996.iso this is the link for the windows 7 ISO
Save the file to your desktop

Download the ISO to your desktop
Insert a blank CD in the drive

Download and install ImgBurn on your computer
Double click the Windows 7 ISO and ImgBurn will open
Screenshots on how to burn the disc are here

Once you have burnt the disc let me know and we will proceed to the next stage
  • 0

#9
traveler818

traveler818

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 140 posts
I can't do it again--it is making me nuts--I wrote a post to update you and because I am so tired, it took awhile. Just before I sent it, MSN popped up and deleted it. (it is bad---every 5-10 minutes). And as of today, I keep getting batches of the same email about 85 search engines. Part of my confusion is in what order to do things. This is getting worse--I will probably not get far tonight--things just keep getting deleted.

I tried to download ISO. But I never saw ISO. My notes are poor (it was late). I ran the 2-hour procedure and when prompted to run or save, I selected save--should i have pressed run? The only icon that popped up was for Windows Disc Image Burner & my option was to insert a CD so I did. Somewhere in here it says download (I will try to take better notes). My notes say download, then password request. I pressed enter and got past that, but i never saw Windows7ISO or IMGBurn. The computer said there was not enough room on the CD and to insert a DVD so I did, and copied a bunch of stuff. The name of the file on the second DVD is x17-58996.iso.

Because i am so isolated, I should be prepared, so I need to know what I may need later. For now, I have 8 DVD's. I am tempted to try using one and saying run instead of save, and I am tempted to click your link below. Anyway, I need to be sure I have enough of anything I may need later. I have 8 CD+R's and 8 DVD+R's. I have a 4 GB flash drive. It is full but I kept it mainly because it was sport around here to delete the user manual files (and I usually don't let anyone near this.) I can get the names of chapters if nothing else and erase that. All in all, I need to order anything I may need. And I need to include the screw-up factor. For ex, if I need 8 more CD's, I will get ten or twelve. If i need any kind of cable...this is threatening to delete. I hope it is complete.
  • 0

#10
traveler818

traveler818

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 140 posts
If I need more storage, having another flash drive wouldn't hurt me any either unless you have a better idea, but if I do not have to spend money that helps too. I can place an order online now if i need to be prepared. If I need nothing else, great. If I do, I want to be ready. I now have 7 blank DVD's & 8 blank CD's.

As for any supplies I may need, please tell me the minimum, and besides CD's & DVD's, what I should have to cover me for the screwup factor.

I am a bit confused about what order in which to do things.
I couldn't find IMGBurn on MajorG's website either--it is a busy site*.

UPDATE: I ran the 2-hour link again, this time, I chose run instead of save. There is an icon on my desktop this time, not just the taskbar. I can double click, right click, or click once--all but once, I got Windows Disc Image Burner. But it could not format the disk, which had to be a DVD, because a CD was too small.

By now,I have really tried to download IMGBurn.

*I found it on the MajorGeeks site, then on two other sites, as the result was always the same: After I saw it for a second, it changed to "Explorer cannot display this page". Just before that, I got a small corner of that (Explorer cannot...) page (always on the bottom right corner) up to 3 x 3 inches--I saw that often before I contacted you but hadn't seen it for awhile, and it still lets me use the page I am on and goes away when I go to another page--I recall no specific site, except maybe gmail, but have a couple of screenshots. Also,2 mights ago, I went out for 2 hours with the computer on because a window was loading, and the message was that to turn the computer off while it was busy could cause damage--After 2 hours, it was still trying to load. That seems directly connected with Bing, which I do not want. It has not happened since I learned to avoid Bing.

Back to IMGBurn: I found gofree.com which seemed perfect, then AVG put up a block saying that was a dangerous site (and the only site the Explorer was willing to display, so that ended that for tonight). AVG has supposedly fixed it but I have no idea what that means--I am not that familiar with AVG--it is not my choice.

Just before I logged off, I double (or right-clicked) the desktop icon. I cannot reproduce it as it went by too fast but I got a different message than just the Disc Image Burner--it seemed to apply--It had instructions on how to create an ISO DVD. It was try that or wait. The option I got in bold was burn disc image, so I selected that. Before, I just got the window. (If that was going to work, this might be my only shot and hopefully, worst case, I just have another DVD I cannot reuse. I do not want to take chances, nor do I want to walk away from hard won opportunity and just to see, I tried many times, but never got that window again. It did not feel like I was taking a chance, just creating a DVD that I hope works, but if not, I hope that is fine. The filename is X17-58996.iso. There are 8 files on the new DVD but I can't copy them to here. If necessary, I can check to see if anything got copied to the first 2 DVD's.
I hope this makes sense and leads to forward progress. It is too late for me to be trying to communicate effectively. Thank you again.
Traveler




Thanks.

Edited by traveler818, 08 November 2012 - 07:03 AM.

  • 0

Advertisements


#11
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
That is the correct ISO image, so were you able to burn the image to disc ?

A way to check is to put the DVD in the computer
Reboot and see if it loads the start page for a windows install
When you reboot you will see this although yours will say windows 7

Posted Image
  • 0

#12
traveler818

traveler818

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 140 posts
Apparently I failed. I have had no time to learn basics--it has been 3 years of this kind of stuff (they come from the factory a mess, but neither Gateway nor Toshiba were willing to replace them with working machines, so I never put anything important online or hooked up peripherals or got any good out of this). I will happily dismantle it with a screwdriver if that is what it takes. Ie basics, maybe the 8 files I saw on the DVD were folders. When I open them, I see many files--it almost looks like everything from the computer is there, though all I did was take a quick look, so cannot be sure (regardless).

I found IMGBurn on MajorGeeks, and this time the Explorer let me see it. But after trying to download it, all I remember is being prompted for a password. I went to the other link you gave me and I think I am supposed to copy the image to the DVD? If so, is that what I did on the disc I referred to herein--I was never able to download IMGBurn before I created it. Tomorrow, unless you have a better idea, I will try that second site and copy the image to the DVD. Please correct me if that is not the best way to go or if that is not what i am supposed to copy--I am really in the dark.

Also, time permitting, would you be able to give me a brief rundown on the procedure we are working on? I am confused, and also want to know all my options (there must be ONE that will work). For example, what is IMGBurn for?

I need rest. Hopefully tomorrow will be more successful. I also have a system backup from Oct 12 that was made just before I got unknowingly locked out. The only thing I know to do at this point is to keep trying to find IMGBurn without needing a password. If there is anything else, please let me know.

When I logged into Geekstogo this morning the Explorer couldn't display the page. It let me in the second time which is unusually fast. The point being that I need to keep moving, so if you do not hear from me, it is because I can't get in. In such a case, I can log in as a guest at the library (closed sun-tues), but that could take a day or two. I want to go as far as I can tomorrow, but one password can stop me before I start unless there's another alternative.
  • 0

#13
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Imgburn will burn the ISO file to the DVD and make it bootable with the entire windows setup on it, so you will have a windows installation DVD

We will then try a reformat and re-install of windows. This will then enable you to control everything

When you run ImgBurn the option you require will be :

Write Image File To Disc
  • 0

#14
traveler818

traveler818

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 140 posts
Today did not go well. I did not awake til 4:30 to discover a sore throat. Still, I have been at this for some time since, but no results, just a couple of surprises. I was able to get the password reset disc to work, hoping to replace her password with one I knew. Oops, the first one I changed was mine, but it works so no biggie. Then I got the disc to work again (nearly unheard of), and changed her password. But she did something to it as so far, the new password doesn't work for me. It was the same procedure both times, and now the password reset disc is refusing to work again.

Somehow I ended up there after clicking the link that took me to the IMGBurn website. Something you had me do yesterday made a small change. Across the top is a list, IMGBurn, ISO Burn & a couple more. But whatever you told me to do changed IMGBurn to IMGBurn Download. I tried a few times last night with no success, and the same today. I am so tired today and up too late. It seems I got no results at all.

I was able to get the repair my computer window, but still got only the startup repair option. That is where I was prompted for a password. I gave my new one, and hers. I got no code just a message saying there was an error with the passwords. I had actually got in with the disk I created, but only got that far.

I was able to get Repair Your Computer again but like the others, only once. I got to the list of users, which had changed slightly, but the next step required a password, which is why the above. It refused them both however, and that ended that.

I have the green discs--one 32-bit, one 64, but they are like the password disc--occasionally they boot but not usually and not today.

If I get to bed before it gets any later, tomorrow I will keep trying to find IMGBurn--if I find it and can download (I don't feel optimistic on that)do I then have to create another disk like the last one (& if so, all on one disc?), or can I try to download IMGBurn onto the one that actually let me in to the OS today? This password issue is proving difficult.
  • 0

#15
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Could you run an OTL scan and I will see if there is anything there that I can fix

Download OTL to your Desktop
Secondary link
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

    Posted Image
  • Select All Users
  • Under the Custom Scan box paste this in

    netsvcs
    BASESERVICES
    %SYSTEMDRIVE%\*.exe
    /md5start
    services.*
    explorer.exe
    winlogon.exe
    Userinit.exe
    svchost.exe
    winsock.*
    /md5stop
    CREATERESTOREPOINT

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Post both logs

  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP