I ve been suspecting someone logging into my computer because a couple of times, during the user log on screen I saw "Signed in remotely from.."

The first timeIi saw some of my pictures copied on the desktop, the second time there were some folders opened when I logged in.
Today, it happened again and this time I was working at the computer. I was logged off out of nowhere, and when I tried to login I saw that someone else was already logged in.
After entering my password, I saw that Web Browser Pass View (which I have not installed on my computer!) was opened and someone tried to save a txt file in the Document folder. I disconnected the LAN cable immediately.

Of course, I changed my windows password a couple of times, but I leanred today that it didn't help.

Has this happened to anybody before? Any suggestions?

I'm running Windows 8.1 Enterprise.

enter image description hereenter image description here

  • 6
    Is this your own personal computer or supplied by your employer?
    – GdD
    Commented Feb 10, 2016 at 11:29
  • 1
    Changing your password didn't help... so maybe the attacker installed a keylogger on your system. Commented Feb 10, 2016 at 11:33
  • 8
    It's rare to have a copy of Windows 8.1 Enterprise running on a personal computer. Did it come from a legitimate source but more importantly, is it fully up-to-date?
    – rustyx
    Commented Feb 10, 2016 at 14:30
  • 1
    Unfortunately, we are not technical support or a malware removal forum. This might be on-topic over at SuperUser.
    – schroeder
    Commented Feb 10, 2016 at 16:36
  • 1
    Have you stop connecting to the internet using this computer? That would be an important first step until you figure out what to do. Is anyone else in charge of maintenance of this computer? Commented Feb 10, 2016 at 18:52

1 Answer 1


It's high likely that your computer has been compromised, probably by a RAT which you caught by drive by download or email attachment. Unless you are a very technical person, I strongly advise the following:

  • Do a malware scan on the system because the attacker probably installed more malware after entering the system (Pro tip: Live boot a Linux system and mount your Windows disk to scan it externally because the attacker might have corrputed the antivirus software)
  • Backup your important data after removing corrupted files
  • Wipe the disk completely
  • Reinstall Windows

Also change all passwords you used on that system immediately, since you need to assume that the confidentiality of all sensible data is lost.

Also think about where you could have infected your PC in the past. This incident should have raised your awareness.

  • 16
    Reinstall is generally the best option in these cases, even if you are very technical - modern malware can be very sneaky, and resurface following attempts to remove it if any traces are missed.
    – Matthew
    Commented Feb 10, 2016 at 11:52
  • 7
    Wiping the system would be the advice of most people. You can't confirm what was installed/added to your machine without a lot of in-depth and skilled work (i.e. the costly work of an IR professional). Barring having costly, business-critical legacy software on the machine, grab the data you need, wipe and start fresh. Commented Feb 10, 2016 at 11:56
  • 2
    To add on to this answer, only back up essential or sentimental files, make sure to submit all of the files to a virus scanner, such as virus-total or whatever you are running on your machine. Also, don't forget to change the password for every account that may be the same or follow the same naming convention as the compromised password.
    – Lutefisk
    Commented Feb 10, 2016 at 14:03
  • 3
    You stopped updating because you think it slows down the system??? This might be the reason you got infected in the first place.
    – AdHominem
    Commented Feb 10, 2016 at 18:31
  • 2
    @cristidonos "i mean i can understand and follow a solution one would provide on this forum" This isn't a forum.
    – Pharap
    Commented Feb 10, 2016 at 19:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .