Is someone taking screen shots of my computer?

lopedoggie · 11 Apr 2017

A special kind of Trojan. You have been hacked. Hard as anything to remove, let alone identify source. The repair is to clean install OS after wiping your main drive ( the OS drive) and reformatting before the install. Or tape over the camera if it a laptop or disable the camera driver, or if it is a PC disconnect webcam. No camera no picture. Malwarebytes pro, Norton Power Eraser, Sophos rootkit scanner can all identify this kind of hack but is a rootkit product and usually will not be removed even when it shows removed. It will become active again upon start up. This my opinion and based on the fact that yes you can hack a camera and its software program if the camera is live during say a facebook session or chat or what ever when you are on the web. Always try to go to trusted websites only and downloading anything from anywhere on the web is a crap shoot. As always backup your valuable data files first before all else. Do not re install the current programs on your computer, you will have to install clean copies of all your current programs.

Just for your information read this article: Can people really spy on me through my laptop's or smartphone's camera?

purplelover · 12 Apr 2017

I have the free one trial. It says everything is fine. As do Windows defender. Do I need to cancel my credit card as it flashed several times when I was ordering?

Is it possible Microsoft outlook is doing this???I have been having trouble with it. I can't mail files or pics online without it wanting to set it up, i don't want it.

I so appreciate your help!!!

Thanks again for helping.

Eileen
\

purplelover · 12 Apr 2017

Lopedoggie

Oh No!!!!! This is a new computer. Mostly I have graphics and pics that I craft with. Could they be hacked too? I can reload my PrintMAster. It has been acting up too. I don't play any games online. Is there a chance the tape, already installed, will work?

I can't imagine reinstalling everything. Plus I don't know how.

I will read what you suggested.

Do I need to cancel my credit card???

Thanks so much for info....Can this Trojan get into my credit info or do damage to my programs????

What is wrong with people???
Eileen

Tony K · 12 Apr 2017

purplelover said:

I have the free one trial. It says everything is fine. As do Windows defender. Do I need to cancel my credit card as it flashed several times when I was ordering?

Is it possible Microsoft outlook is doing this???I have been having trouble with it. I can't mail files or pics online without it wanting to set it up, i don't want it.

I so appreciate your help!!!

Thanks again for helping.

Eileen
\

The only way to tell if your credit card got compromised is through that company and watching the daily register tally. If people have it they will use it. I would suggest you call that company and see and/or look at the account online.

So far as your computer > As Lopedoggie suggested, it may have been hacked and difficult to tell. We can guide you through a fresh Windows install if need be, have friend/relative who knows how, or take it to take it to a PC shop.

simrick · 12 Apr 2017

Hi.
Usually webcam trojans are RATs - Remote Access Trojans - and someone would usually need access to your system to install them, although they could be installed from malicious sites. However, it would behoove you to identify what you have, so you know what kind of damage has been done (password stealer, etc.), and if it's easily cleaned, or requires a fresh install of the operating system.

For the credit card, you can certainly watch the charges on it - some thieves will run a small charge through to see if they can get away with it, and then if successful, start charging things (usually gift e-cards). But many will sit on it for a while so you let your guard down, or sell it on the dark web. Stolen cards may not show activity for months.

This is why I think it's important to determine if you really are infected or not, and if so, what infection you have.

Malwarebytes should be run using the Custom Scan option, checking the box to include rootkits, and selecting all drives ever attached to the system at any time.

I see you have Avast on it. I'm fairly confident that Avast would prevent a RAT from installing, unless you were duped into installing it by a malicious site.

Another scan you could try is ESET Online Scanner. (Click the Scan Now button.)

The third thing I would run is ADWCleaner.

Malwarebytes and ESET will take quite some time to run; ADWCleaner is quick, and you might run that first. If it finds anything, you should post the logs here for review. They will be found in the root of your C drive.

The address of any site that you visit which exhibits this strange behaviour should be scanned at virustotal.com, and blocked if found to be necessary.

Reset Chrome to remove all extensions. Chrome is not a very safe browser, and I don't use it except when necessary.

Here's some reading for you:
How hackers can switch on your webcam and control your computer

Chrome Bugs Lets Sites Listen to Your Private Conversations

Of course, a clean install is really the only way to be sure you've removed everything, but it's good to know what it is you're dealing with, and how much potential damage has been done.

p.s. my webcam has black tape over it at all times.

NavyLCDR · 12 Apr 2017

I'm finding this interesting.... unless I am missing something here, the only description of the mysterious behavior we have is this:

purplelover said:

O.K. I am a bit scared. I am still on AOL. Lately I have been on a webpage and I notice a clear square shaped box with a black frame on it. It flashes like a picture being taken. Is this even possible?

I'm sorry, this just does not seem much to go on to start all the theories about hackers having access to the computer. And let's go with the hacker theory for a minute. Exactly why would a hacker put an icon on a computer to indicate their activity?

Exactly where is this clear shaped box box with a black frame on it that flashes? Is it on the task bar? Is it in the notification area? Is it on a web page? Is it always there when you turn your computer on? Do you get any kind of menu when you right click on it? Can you post a screenshot of it?

Take Screenshot in Windows 10 - Windows 10 General Tips Tutorials

Disk Management - How to Post a Screenshot of - Windows 10 General Tips Tutorials

For all we know right now, based on the limited description, it could be just an animated touchpad driver indicator

simrick · 12 Apr 2017

Good point Navy.

That's why I said we need to determine if she really is infected or not.

lopedoggie · 12 Apr 2017

You need a tech buddy to look at this for you. A first step if you remotely think you are infected with malware, if you bank or shop online is to change those account passwords immediately. Not trying to panic you just routine advice for protecting your assets. I have had experience with trojans, keyloggers etc. Hardest to get rid and even determine if you have except when everything goes wonko boom or worse when you start getting the pay to fix messages, emails etc. I was just saying what i would do.

clam1952 · 12 Apr 2017

NavyLCDR said:

I'm finding this interesting.... unless I am missing something here, the only description of the mysterious behavior we have is this:

I'm sorry, this just does not seem much to go on to start all the theories about hackers having access to the computer. And let's go with the hacker theory for a minute. Exactly why would a hacker put an icon on a computer to indicate their activity?

Exactly where is this clear shaped box box with a black frame on it that flashes? Is it on the task bar? Is it in the notification area? Is it on a web page? Is it always there when you turn your computer on? Do you get any kind of menu when you right click on it? Can you post a screenshot of it?

Take Screenshot in Windows 10 - Windows 10 General Tips Tutorials

Disk Management - How to Post a Screenshot of - Windows 10 General Tips Tutorials

For all we know right now, based on the limited description, it could be just an animated touchpad driver indicator

I'm guessing the OP is using AOL Desktop?
In which case possibly this? post 11 onwards Black box pops up and goes off after Desktop login or browser opens! - Tech Support Forum

Winuser · 12 Apr 2017

If you do change your passwords don't use the infected computer to do it. Either clean install Windows first or if you have another computer use that one.