Windows started opening pop-ups and a command prompt typed net use. I closed spacedesk and the activity stopped, but I don't know if it was the cause. I've uninstalled it and a malware scan came back clean. What else should I do, and could my accounts or files be at risk?
Someone appeared to control my PC remotely. What should I do next?
Answers
First, disconnect the PC from the network, including Wi-Fi. From a different trusted device, change the passwords for important accounts used on that PC, especially email, and review their security settings and recent activity.
Back up important documents and photos before doing anything drastic. Avoid relying on programs or installers from the affected machine. If someone really had control of it, a clean Windows installation from USB is the more cautious route. A clean scan doesn't prove the system is clean.
Reply to this answer
Net use is a valid Windows command, not necessarily a mistyped net user. It can show or manage network connections such as mapped drives. Net user is a separate command for viewing and managing user accounts.
The command alone doesn't tell you what the person intended or whether anything was taken. But a command prompt typing by itself is enough reason to treat the machine as potentially compromised.
Reply to this answer
If you're not ready to reinstall, you could run a Microsoft Defender Offline scan as another check. Also look through installed programs sorted by installation date and note anything unfamiliar, particularly remote access tools you didn't knowingly install.
Don't assume an unfamiliar entry is malicious without checking it. Legitimate remote management software may not be flagged by a malware scanner, and even a second clean scan can't rule out a compromise.
Reply to this answer
Spacedesk stopping at the same time is a clue, not proof of how access happened. I'd check where the installer came from and review its connection and security settings before using it again. Something else on the PC could also have provided access.
Reply to this answer
Add your answer
Answers are reviewed before publication.
5u!clampnotebook_287:
Check whether your accounts have two-factor authentication enabled too, and review signed-in devices or sessions where the service offers that option.