🕷️ Crawler Inspector

URL Lookup

Direct Parameter Lookup

Raw Queries and Responses

1. Shard Calculation

Query:

Response:

Calculated Shard: 86 (from laksa074)

2. Crawled Status Check

Query:

curl -X POST \
  'http://laksa086.int.ahrefs:8124/' \
  -H 'Content-Type: text/plain' \
  -H 'X-ClickHouse-Database: crawler3' \
  -H 'Authorization: Basic YXBpOg==' \
  -d 'SELECT getAhrefsURLFromUnparsed(src_unparsed) AS found_url, ifNull(toUnixTimestamp(download_stamp), 0) AS crawl_time, ifNull(toUnixTimestamp(props_url_first_seen), 0) AS first_indexed_time, download_http_code AS http_code, src_unparsed AS src_unparsed, src_root_hash AS src_root_hash, history_drop_reason AS history_drop_reason, meta_title AS meta_title, meta_descriptions AS meta_descriptions, attrs_boilerpipe_text AS attrs_boilerpipe_text, attrs_markdown AS attrs_markdown, attrs_readable_markdown AS attrs_readable_markdown, meta_canonical AS meta_canonical FROM crawler3.page_info_local FINAL PREWHERE (src_root_hash, src_unparsed) IN ((getAhrefsRootHashFromUnparsed(getAhrefsUnparsedNoserviceFromURL(\'https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/\')), getAhrefsUnparsedNoserviceFromURL(\'https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/\'))) FORMAT JSONEachRow'

Response:

{"found_url":"https:\/\/www.bleepingcomputer.com\/forums\/t\/814189\/suspected-scam-andor-rat-help-needed\/","crawl_time":1773796644,"first_indexed_time":0,"http_code":200,"src_unparsed":"com,bleepingcomputer!www,\/forums\/t\/814189\/suspected-scam-andor-rat-help-needed\/ s443","src_root_hash":"2588408978880255886","history_drop_reason":null,"meta_title":"Suspected Scam and\/or RAT Help needed - Anti-Virus, Anti-Malware, and Privacy Software","meta_descriptions":["Suspected Scam and\/or RAT Help needed - posted in Anti-Virus, Anti-Malware, and Privacy Software: Mod: Please delete. Moved to another thread after seeing that this forum is closed About a month ago my desktop pc (Windows 10) must have been hacked. I woke up one morning, noticed that while I was asleep, my browser (chrome) had visited Paypal with several attempted purchases of gift cards or crypto. They had also visited my gmail and moved the paypal log-in confirmation emails etc. t..."],"attrs_boilerpipe_text":"#1\nGWC71\nMembers\n12 posts\nOFFLINE\n \nLocal time:\n09:17 PM\nPosted\n04 March 2026 - 01:42 PM\nMod: Please delete. Moved to another thread after seeing that this forum is closed\nAbout a month ago my desktop pc (Windows 10) must have been hacked. I woke up one morning, noticed that while I was asleep, my browser (chrome) had visited Paypal with several attempted purchases of gift cards or crypto. They had also visited my gmail and moved the paypal log-in confirmation emails etc. to the trash - trying to cover their tracks (but forgot to delete the trash). I immidiately called paypal, none of the purchases were successful but I changed my password and that of my gmail etc. as well. I also updated my chrome browser and ran my installed security programs (RogueKiller, Malwarebytes, SuperAntiSpyware), which found nothing.\nI did't see any suspiscious activity for several weeks, figured maybe the browser update may have fixed a security hole. Then the other evening I noticed my desktop screensaver had gone off and there was a blue window open on my desktop with the word \"Support\". I could see a mouse curser moving around, obviously a remote hack. I instantly shut the power off to the pc, unplugged my modem and restarted the pc. While waiting for it to reboot my phone alerted me to email from Paypal (regarding an email password change) and also got a phone text message (2 factor authentication) from paypal with an password reset access code. Once the pc booted, I kept internet off and opened chrome to see if I could get the history. There was evidence of an attempt to access my paypal (unsuccessful) and no evidence of someone messing around in my gmail. After this, I ran those basic av scans and added ESET online scan which identified an old program (utorrent - removed) and a potential trojan (I believe it was part of Microsoft visual ++)\nNow I just checked a lesser used email account (Not the account from the paypal issues) and found a \"ransome note\" in my junk folder from \"myself\" (that lesser used account) from Tuesday, which I can copy and paste here if needed.\nI'm assuming all of these issues are connected and it sounds serious to me. Is there a way to find and get rid of whatever this is? I'm not tech savy enough to understand anything like this and could really use some help. Thanks!\nEdited by quietman7, 04 March 2026 - 05:40 PM.\nBack to top\nBC AdBot (Login to Remove)\nBleepingComputer.com\nRegister to remove ads\n#2\nquietman7\nquietman7\nBleepin' Gumshoe\nGlobal Moderator\n65,698 posts\nOFFLINE\n \nGender:\nMale\nLocation:\nVirginia, USA\nLocal time:\n09:17 PM\nPosted\n04 March 2026 - 05:40 PM\nFrom what you describe you are probably dealing with some sort of tech support scam and hacking. \n \nYou may want to read\nBeware of Phony Emails, Phone Calls, Tech Support Scams\n(Post #13) for more information about how these scams work.\n \nActual ransomware usually will have\nobvious indications\n(\nsigns of infection\nor\nsigns of ransomware activity\n) that something is wrong...it typically targets and encrypts data files so you cannot open them locally (and on any connected drives at the time of infection),\nin most cases it appends an obvious extension\n(may be random random or with an id and\/or email address)\nto the end or beginning\nof encrypted filenames,\ndemands a ransom payment by dropping ransom notes\nin every directory or affected folder where data has been encrypted and sometimes changes Windows wallpaper. In rare cases the criminals will send victims an email with the ransom demands as reported\nhere\n.\n \nIf you need individual assistance from our experts with finding\/removing a possible malware infection, checking for possible hacking or just need a second opinion, there are advanced tools which can be used to investigate but they\nare not permitted in this forum\n. If you need such help, please follow the instructions in the\nMalware Removal and Log Section Preparation Guide\n. After doing that, they should start a new topic and post their\nFRST logs\nin the\nVirus, Trojan, Spyware, and Malware Removal Logs Forum\n,\nNOT here\n, for assistance by the Malware Response Team.\n \nIf you choose to follow the above instructions, please reply back in this thread with a link to the new topic.\n \nThe BC Staff\nBack to top","attrs_markdown":"- [![Log in with Twitter](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_images\/master\/loginmethods\/twitter.png)](https:\/\/www.bleepingcomputer.com\/forums\/index.php?app=core&module=global&section=login&serviceClick=twitter)  [Sign In](https:\/\/www.bleepingcomputer.com\/forums\/index.php?app=core&module=global&section=login \"Sign In\")\n- [Create Account](https:\/\/www.bleepingcomputer.com\/forums\/index.php?app=core&module=global&section=register \"Create Account\")\n\n[![Logo](https:\/\/www.bleepstatic.com\/logo\/forum-logo.png)](https:\/\/www.bleepingcomputer.com\/ \"Go to community index\")\n\n- [View New Content](https:\/\/www.bleepingcomputer.com\/forums\/index.php?app=core&module=search&do=viewNewContent&search_app=forums)\n- [Forum Rules](https:\/\/www.bleepingcomputer.com\/forum-rules\/)\n- [BleepingComputer.com](https:\/\/www.bleepingcomputer.com\/ \"Homepage\")\n- [Forums](https:\/\/www.bleepingcomputer.com\/forums\/ \"Go to Forums\")\n- [Members](https:\/\/www.bleepingcomputer.com\/forums\/members\/ \"Go to Members\")\n- [Tutorials](https:\/\/www.bleepingcomputer.com\/tutorials\/ \"Computer Tutorials\")\n- [Startup List](https:\/\/www.bleepingcomputer.com\/startups\/ \"Startup Database\")\n- [Virus Removal](https:\/\/www.bleepingcomputer.com\/virus-removal\/ \"Virus Removal Guides\")\n- [Downloads](https:\/\/www.bleepingcomputer.com\/download\/ \"Downloads\")\n- [Uninstall List](https:\/\/www.bleepingcomputer.com\/uninstall\/ \"Uninstall List\")\n- [Welcome Guide](https:\/\/www.bleepingcomputer.com\/welcome-guide\/ \"Welcome Guide\")\n- [More ![Options arrow](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_images\/master\/useropts_arrow.png)](https:\/\/www.bleepingcomputer.com\/forums\/t\/814189\/suspected-scam-andor-rat-help-needed\/)\n\n1. [BleepingComputer Forums](https:\/\/www.bleepingcomputer.com\/forums\/)\n2. → [Security](https:\/\/www.bleepingcomputer.com\/forums\/f\/79\/security\/ \"Return to Security\")\n3. → [Anti-Virus, Anti-Malware, and Privacy Software](https:\/\/www.bleepingcomputer.com\/forums\/f\/25\/anti-virus-anti-malware-and-privacy-software\/ \"Return to Anti-Virus, Anti-Malware, and Privacy Software\")\n\n**Javascript Disabled Detected**\n\nYou currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.\n\nRegister a free account to unlock additional features at BleepingComputer.com\n\nWelcome to **BleepingComputer**, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having **no ads** shown anywhere on the site.\n\n[**Click here to Register a free account now\\!**](https:\/\/www.bleepingcomputer.com\/forums\/index.php?app=core&module=global&section=register) or read our [**Welcome Guide**](https:\/\/www.bleepingcomputer.com\/forums\/t\/814189\/suspected-scam-andor-rat-help-needed\/%0Ahttps:\/\/www.bleepingcomputer.com\/welcome-guide\/) to learn how to use this site.\n\n**Latest News:** [Apple pushes first Background Security Improvements update to fix WebKit flaw](https:\/\/www.bleepingcomputer.com\/news\/security\/apple-pushes-first-background-security-improvements-update-to-fix-webkit-flaw\/)\n\n**Featured Deal:** [One app, every AI model: 1min.AI is now on lifetime deal](https:\/\/www.bleepingcomputer.com\/offer\/deals\/one-app-every-ai-model-1minai-is-now-on-lifetime-deal\/)\n\n**Latest Buyer's Guide:**  [Best VPNs in 2025](https:\/\/www.bleepingcomputer.com\/vpn\/guides\/best-vpn\/)\n\n![Generic User Avatar](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_images\/master\/profile\/default_large.png)\n\n# Suspected Scam and\/or RAT Help needed\nStarted by  GWC71 , Mar 04 2026 01:42 PM\n\n- Please log in to reply\n\n1 reply to this topic\n\n### [\\#1 ![](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_images\/master\/icon_share.png)](https:\/\/www.bleepingcomputer.com\/forums\/t\/814189\/suspected-scam-andor-rat-help-needed\/#entry5844281 \"Suspected Scam and\/or RAT Help needed: post #1\")    GWC71\nGWC71\n\n- ![ Avatar image](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_images\/master\/profile\/default_large.png)\n- Members\n- 12 posts\n- OFFLINE\n\n- Local time:09:17 PM\n\nPosted 04 March 2026 - 01:42 PM\n\nMod: Please delete. Moved to another thread after seeing that this forum is closed\n\nAbout a month ago my desktop pc (Windows 10) must have been hacked. I woke up one morning, noticed that while I was asleep, my browser (chrome) had visited Paypal with several attempted purchases of gift cards or crypto. They had also visited my gmail and moved the paypal log-in confirmation emails etc. to the trash - trying to cover their tracks (but forgot to delete the trash). I immidiately called paypal, none of the purchases were successful but I changed my password and that of my gmail etc. as well. I also updated my chrome browser and ran my installed security programs (RogueKiller, Malwarebytes, SuperAntiSpyware), which found nothing.\n\nI did't see any suspiscious activity for several weeks, figured maybe the browser update may have fixed a security hole. Then the other evening I noticed my desktop screensaver had gone off and there was a blue window open on my desktop with the word \"Support\". I could see a mouse curser moving around, obviously a remote hack. I instantly shut the power off to the pc, unplugged my modem and restarted the pc. While waiting for it to reboot my phone alerted me to email from Paypal (regarding an email password change) and also got a phone text message (2 factor authentication) from paypal with an password reset access code. Once the pc booted, I kept internet off and opened chrome to see if I could get the history. There was evidence of an attempt to access my paypal (unsuccessful) and no evidence of someone messing around in my gmail. After this, I ran those basic av scans and added ESET online scan which identified an old program (utorrent - removed) and a potential trojan (I believe it was part of Microsoft visual ++)\n\nNow I just checked a lesser used email account (Not the account from the paypal issues) and found a \"ransome note\" in my junk folder from \"myself\" (that lesser used account) from Tuesday, which I can copy and paste here if needed.\n\nI'm assuming all of these issues are connected and it sounds serious to me. Is there a way to find and get rid of whatever this is? I'm not tech savy enough to understand anything like this and could really use some help. Thanks\\!\n\n**Edited by quietman7, 04 March 2026 - 05:40 PM.**\n\n- [![Back to top of page button](https:\/\/www.bleepstatic.com\/skin_images\/bc\/post_top.png) Back to top](https:\/\/www.bleepingcomputer.com\/forums\/t\/814189\/suspected-scam-andor-rat-help-needed\/#ipboard_body \"<img alt=\\\"Back to top of page button\\\" src=\\\"\/\/www.bleepstatic.com\/skin_images\/bc\/post_top.png\\\"> Back to top\")\n***\n### BC AdBot (Login to Remove)\n- ![](https:\/\/www.bleepstatic.com\/images\/site\/forum\/bots\/bot.jpg)\n- BleepingComputer.com\n- [Register to remove ads](https:\/\/www.bleepingcomputer.com\/forums\/index.php?app=core&module=global&section=register)\n***\n### [\\#2 ![](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_images\/master\/icon_share.png)](https:\/\/www.bleepingcomputer.com\/forums\/t\/814189\/suspected-scam-andor-rat-help-needed\/#entry5844313 \"Suspected Scam and\/or RAT Help needed: post #2\")    quietman7\nquietman7\n\n- ![ Avatar image](https:\/\/www.bleepingcomputer.com\/forums\/uploads\/profile\/photo-thumb-26513.jpg?_r=1738668977)\n- Global Moderator\n- 65,698 posts\n- OFFLINE\n\n- Gender:Male\n- Location:Virginia, USA\n- Local time:09:17 PM\n\nPosted 04 March 2026 - 05:40 PM\n\nFrom what you describe you are probably dealing with some sort of tech support scam and hacking.   \n   \n You may want to read **[Beware of Phony Emails, Phone Calls, Tech Support Scams](https:\/\/www.bleepingcomputer.com\/forums\/t\/407147\/answers-to-common-security-questions-best-practices\/?p=3897161)** (Post \\#13) for more information about how these scams work.  \n   \n Actual ransomware usually will have **obvious indications** ([signs of infection](https:\/\/blog.rsisecurity.com\/how-to-identify-signs-of-ransomware-attacks\/ \"External link\") or [signs of ransomware activity](https:\/\/learn.microsoft.com\/en-us\/defender-xdr\/advanced-hunting-find-ransomware?view=o365-worldwide#check-for-individual-signs-of-ransomware-activity \"External link\")) that something is wrong...it typically targets and encrypts data files so you cannot open them locally (and on any connected drives at the time of infection), **in most cases it appends an obvious extension** (may be random random or with an id and\/or email address) **to the end or beginning** of encrypted filenames, **demands a ransom payment by dropping ransom notes** in every directory or affected folder where data has been encrypted and sometimes changes Windows wallpaper. In rare cases the criminals will send victims an email with the ransom demands as reported [here](https:\/\/www.bleepingcomputer.com\/news\/security\/new-agelocker-ransomware-uses-googlers-utility-to-encrypt-files\/).  \n   \n If you need individual assistance from our experts with finding\/removing a possible malware infection, checking for possible hacking or just need a second opinion, there are advanced tools which can be used to investigate but they **are not permitted in this forum**. If you need such help, please follow the instructions in the **[Malware Removal and Log Section Preparation Guide](https:\/\/www.bleepingcomputer.com\/forums\/t\/34773\/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help\/)**. After doing that, they should start a new topic and post their **FRST logs** in the [Virus, Trojan, Spyware, and Malware Removal Logs Forum](https:\/\/www.bleepingcomputer.com\/forums\/f\/22\/virus-trojan-spyware-and-malware-removal-logs\/), **NOT here**, for assistance by the Malware Response Team.  \n   \n If you choose to follow the above instructions, please reply back in this thread with a link to the new topic.  \n   \n The BC Staff\n\n.  \n .  \n**[Microsoft MVP Alumni 2023](https:\/\/www.credly.com\/badges\/de45155a-3505-4de9-99bf-949c61b5132f\/linked_in?t=rutxb1 \"External link\")**, Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023\n\n**Microsoft MVP Consumer Security 2007-2015** [![kO7xOZh.gif](https:\/\/i.imgur.com\/kO7xOZh.gif)](https:\/\/www.thewindowsclub.com\/tips-become-microsoft-mvp-mcc \"External link\")  \nMember of **[UNITE](https:\/\/www.allacronyms.com\/UNITE\/Unified_Network_of_Instructors_and_Trusted_Eliminators \"External link\")**, Unified Network of Instructors and Trusted Eliminators  \n[Retired Police Officer, Federal Agent and Coast Guard Chief](https:\/\/www.linkedin.com\/in\/louis-russell-stamm-iii-742486111\/ \"External link\")  \n  \n**If I have been helpful & you'd like to consider a donation, click** [![38WxTfO.gif](https:\/\/i.imgur.com\/38WxTfO.gif)](https:\/\/www.paypal.me\/quietman7 \"External link\")\n\n- [![Back to top of page button](https:\/\/www.bleepstatic.com\/skin_images\/bc\/post_top.png) Back to top](https:\/\/www.bleepingcomputer.com\/forums\/t\/814189\/suspected-scam-andor-rat-help-needed\/#ipboard_body \"<img alt=\\\"Back to top of page button\\\" src=\\\"\/\/www.bleepstatic.com\/skin_images\/bc\/post_top.png\\\"> Back to top\")\n***\n***\n[Back to Anti-Virus, Anti-Malware, and Privacy Software](https:\/\/www.bleepingcomputer.com\/forums\/f\/25\/anti-virus-anti-malware-and-privacy-software\/)\n\n- [![twitter share button](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_extra\/sharelinks\/twitter.png)](https:\/\/www.bleepingcomputer.com\/forums\/index.php?sharelink=twitter;aHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vZm9ydW1zL3QvODE0MTg5L3N1c3BlY3RlZC1zY2FtLWFuZG9yLXJhdC1oZWxwLW5lZWRlZC8,;U3VzcGVjdGVkIFNjYW0gYW5kL29yIFJBVCBIZWxwIG5lZWRlZA,, \"Share this link via Twitter\")\n- [![digg share button](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_extra\/sharelinks\/digg.png)](https:\/\/www.bleepingcomputer.com\/forums\/index.php?sharelink=digg;aHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vZm9ydW1zL3QvODE0MTg5L3N1c3BlY3RlZC1zY2FtLWFuZG9yLXJhdC1oZWxwLW5lZWRlZC8,;U3VzcGVjdGVkIFNjYW0gYW5kL29yIFJBVCBIZWxwIG5lZWRlZA,, \"Share this link via Digg\")\n- [![delicious share button](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_extra\/sharelinks\/delicious.png)](https:\/\/www.bleepingcomputer.com\/forums\/index.php?sharelink=delicious;aHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vZm9ydW1zL3QvODE0MTg5L3N1c3BlY3RlZC1zY2FtLWFuZG9yLXJhdC1oZWxwLW5lZWRlZC8,;U3VzcGVjdGVkIFNjYW0gYW5kL29yIFJBVCBIZWxwIG5lZWRlZA,, \"Share this link via Del.icio.us\")\n- [![reddit share button](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_extra\/sharelinks\/reddit.png)](https:\/\/www.bleepingcomputer.com\/forums\/index.php?sharelink=reddit;aHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vZm9ydW1zL3QvODE0MTg5L3N1c3BlY3RlZC1zY2FtLWFuZG9yLXJhdC1oZWxwLW5lZWRlZC8,;U3VzcGVjdGVkIFNjYW0gYW5kL29yIFJBVCBIZWxwIG5lZWRlZA,, \"Share this link via Reddit\")\n- [![stumble share button](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_extra\/sharelinks\/stumble.png)](https:\/\/www.bleepingcomputer.com\/forums\/index.php?sharelink=stumble;aHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vZm9ydW1zL3QvODE0MTg5L3N1c3BlY3RlZC1zY2FtLWFuZG9yLXJhdC1oZWxwLW5lZWRlZC8,;U3VzcGVjdGVkIFNjYW0gYW5kL29yIFJBVCBIZWxwIG5lZWRlZA,, \"Share this link via StumbleUpon\")\n- [![print share button](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_extra\/sharelinks\/print.png)](https:\/\/www.bleepingcomputer.com\/forums\/index.php?sharelink=print;aHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vZm9ydW1zL3QvODE0MTg5L3N1c3BlY3RlZC1zY2FtLWFuZG9yLXJhdC1oZWxwLW5lZWRlZC8,;U3VzcGVjdGVkIFNjYW0gYW5kL29yIFJBVCBIZWxwIG5lZWRlZA,, \"Print\")\n- [![download share button](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_extra\/sharelinks\/download.png)](https:\/\/www.bleepingcomputer.com\/forums\/index.php?sharelink=download;aHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vZm9ydW1zL3QvODE0MTg5L3N1c3BlY3RlZC1zY2FtLWFuZG9yLXJhdC1oZWxwLW5lZWRlZC8,;U3VzcGVjdGVkIFNjYW0gYW5kL29yIFJBVCBIZWxwIG5lZWRlZA,, \"Download\")\n\n#### 2 user(s) are reading this topic\n0 members, 2 guests, 0 anonymous users\n\nReply to quoted posts [Clear](https:\/\/www.bleepingcomputer.com\/forums\/t\/814189\/suspected-scam-andor-rat-help-needed\/ \"Clear the posts you have selected with MultiQuote\")\n\n1. [BleepingComputer Forums](https:\/\/www.bleepingcomputer.com\/forums\/)\n2. → [Security](https:\/\/www.bleepingcomputer.com\/forums\/f\/79\/security\/ \"Return to Security\")\n3. → [Anti-Virus, Anti-Malware, and Privacy Software](https:\/\/www.bleepingcomputer.com\/forums\/f\/25\/anti-virus-anti-malware-and-privacy-software\/ \"Return to Anti-Virus, Anti-Malware, and Privacy Software\")\n4. [Privacy Policy](https:\/\/www.bleepingcomputer.com\/privacy\/)\n5. [Rules](http:\/\/www.bleepingcomputer.com\/forum-rules\/) ·\n\n[![Go to top of page image](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_images\/master\/top.png)](https:\/\/www.bleepingcomputer.com\/forums\/t\/814189\/suspected-scam-andor-rat-help-needed\/#top \"Go to top\")\n\n- ![RSS Feed](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_images\/master\/feed.png)\n- [Help](https:\/\/www.bleepingcomputer.com\/forums\/index.php?app=core&module=help \"View help\")\n\n|   |\n|---|\n| [Advertise](https:\/\/www.bleepingcomputer.com\/advertise\/) \\| [About Us](https:\/\/www.bleepingcomputer.com\/about\/) \\| [Terms of Use](https:\/\/www.bleepingcomputer.com\/terms-of-use\/) \\| [Privacy Policy](https:\/\/www.bleepingcomputer.com\/privacy\/) \\| [Sitemap](https:\/\/www.bleepingcomputer.com\/sitemap\/) \\| [Chat](https:\/\/www.bleepingcomputer.com\/forums\/t\/730914\/the-bleepingcomputer-official-discord-chat-server-come-join-the-fun\/) \\| [RSS Feeds](https:\/\/www.bleepingcomputer.com\/rss-feeds\/) \\| [Contact Us](https:\/\/www.bleepingcomputer.com\/contact\/) |\n| [Tech Support Forums](https:\/\/www.bleepingcomputer.com\/forums\/) \\| [Virus Removal Guides](https:\/\/www.bleepingcomputer.com\/virus-removal\/) \\| [Downloads](https:\/\/www.bleepingcomputer.com\/download\/) \\| [Tutorials](https:\/\/www.bleepingcomputer.com\/tutorials\/) \\| [The Computer Glossary](https:\/\/www.bleepingcomputer.com\/glossary\/) \\| [Uninstall List](https:\/\/www.bleepingcomputer.com\/uninstall\/) \\| [Startups](https:\/\/www.bleepingcomputer.com\/startups\/) |\n\n© 2004-2026 All Rights Reserved  [**Bleeping Computer LLC**](https:\/\/www.bleepingcomputer.com\/) .\n\n[Site Changelog](https:\/\/www.bleepingcomputer.com\/changelog\/)\n\n[Community Forum Software by IP.Board](http:\/\/www.invisionpower.com\/apps\/board\/ \"Community Forum Software by Invision Power Services\")","attrs_readable_markdown":"### [\\#1 ![](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_images\/master\/icon_share.png)](https:\/\/www.bleepingcomputer.com\/forums\/t\/814189\/suspected-scam-andor-rat-help-needed\/#entry5844281 \"Suspected Scam and\/or RAT Help needed: post #1\")\nGWC71\n\n- ![ Avatar image](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_images\/master\/profile\/default_large.png)\n- Members\n- 12 posts\n- OFFLINE\n\n- Local time:09:17 PM\n\nPosted 04 March 2026 - 01:42 PM\n\nMod: Please delete. Moved to another thread after seeing that this forum is closed\n\nAbout a month ago my desktop pc (Windows 10) must have been hacked. I woke up one morning, noticed that while I was asleep, my browser (chrome) had visited Paypal with several attempted purchases of gift cards or crypto. They had also visited my gmail and moved the paypal log-in confirmation emails etc. to the trash - trying to cover their tracks (but forgot to delete the trash). I immidiately called paypal, none of the purchases were successful but I changed my password and that of my gmail etc. as well. I also updated my chrome browser and ran my installed security programs (RogueKiller, Malwarebytes, SuperAntiSpyware), which found nothing.\n\nI did't see any suspiscious activity for several weeks, figured maybe the browser update may have fixed a security hole. Then the other evening I noticed my desktop screensaver had gone off and there was a blue window open on my desktop with the word \"Support\". I could see a mouse curser moving around, obviously a remote hack. I instantly shut the power off to the pc, unplugged my modem and restarted the pc. While waiting for it to reboot my phone alerted me to email from Paypal (regarding an email password change) and also got a phone text message (2 factor authentication) from paypal with an password reset access code. Once the pc booted, I kept internet off and opened chrome to see if I could get the history. There was evidence of an attempt to access my paypal (unsuccessful) and no evidence of someone messing around in my gmail. After this, I ran those basic av scans and added ESET online scan which identified an old program (utorrent - removed) and a potential trojan (I believe it was part of Microsoft visual ++)\n\nNow I just checked a lesser used email account (Not the account from the paypal issues) and found a \"ransome note\" in my junk folder from \"myself\" (that lesser used account) from Tuesday, which I can copy and paste here if needed.\n\nI'm assuming all of these issues are connected and it sounds serious to me. Is there a way to find and get rid of whatever this is? I'm not tech savy enough to understand anything like this and could really use some help. Thanks\\!\n\n**Edited by quietman7, 04 March 2026 - 05:40 PM.**\n\n- [![Back to top of page button](https:\/\/www.bleepstatic.com\/skin_images\/bc\/post_top.png) Back to top](https:\/\/www.bleepingcomputer.com\/forums\/t\/814189\/suspected-scam-andor-rat-help-needed\/#ipboard_body \"<img alt=\\\"Back to top of page button\\\" src=\\\"\/\/www.bleepstatic.com\/skin_images\/bc\/post_top.png\\\"> Back to top\")\n***\n### BC AdBot (Login to Remove)\n- ![](https:\/\/www.bleepstatic.com\/images\/site\/forum\/bots\/bot.jpg)\n- BleepingComputer.com\n- [Register to remove ads](https:\/\/www.bleepingcomputer.com\/forums\/index.php?app=core&module=global&section=register)\n***\n### [\\#2 ![](https:\/\/www.bleepingcomputer.com\/forums\/public\/style_images\/master\/icon_share.png)](https:\/\/www.bleepingcomputer.com\/forums\/t\/814189\/suspected-scam-andor-rat-help-needed\/#entry5844313 \"Suspected Scam and\/or RAT Help needed: post #2\")    quietman7\nquietman7\n\n- ![ Avatar image](https:\/\/www.bleepingcomputer.com\/forums\/uploads\/profile\/photo-thumb-26513.jpg?_r=1738668977)\n- Global Moderator\n- 65,698 posts\n- OFFLINE\n\n- Gender:Male\n- Location:Virginia, USA\n- Local time:09:17 PM\n\nPosted 04 March 2026 - 05:40 PM\n\nFrom what you describe you are probably dealing with some sort of tech support scam and hacking.\n\nYou may want to read **[Beware of Phony Emails, Phone Calls, Tech Support Scams](https:\/\/www.bleepingcomputer.com\/forums\/t\/407147\/answers-to-common-security-questions-best-practices\/?p=3897161)** (Post \\#13) for more information about how these scams work.\n\nActual ransomware usually will have **obvious indications** ([signs of infection](https:\/\/blog.rsisecurity.com\/how-to-identify-signs-of-ransomware-attacks\/ \"External link\") or [signs of ransomware activity](https:\/\/learn.microsoft.com\/en-us\/defender-xdr\/advanced-hunting-find-ransomware?view=o365-worldwide#check-for-individual-signs-of-ransomware-activity \"External link\")) that something is wrong...it typically targets and encrypts data files so you cannot open them locally (and on any connected drives at the time of infection), **in most cases it appends an obvious extension** (may be random random or with an id and\/or email address) **to the end or beginning** of encrypted filenames, **demands a ransom payment by dropping ransom notes** in every directory or affected folder where data has been encrypted and sometimes changes Windows wallpaper. In rare cases the criminals will send victims an email with the ransom demands as reported [here](https:\/\/www.bleepingcomputer.com\/news\/security\/new-agelocker-ransomware-uses-googlers-utility-to-encrypt-files\/).\n\nIf you need individual assistance from our experts with finding\/removing a possible malware infection, checking for possible hacking or just need a second opinion, there are advanced tools which can be used to investigate but they **are not permitted in this forum**. If you need such help, please follow the instructions in the **[Malware Removal and Log Section Preparation Guide](https:\/\/www.bleepingcomputer.com\/forums\/t\/34773\/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help\/)**. After doing that, they should start a new topic and post their **FRST logs** in the [Virus, Trojan, Spyware, and Malware Removal Logs Forum](https:\/\/www.bleepingcomputer.com\/forums\/f\/22\/virus-trojan-spyware-and-malware-removal-logs\/), **NOT here**, for assistance by the Malware Response Team.\n\nIf you choose to follow the above instructions, please reply back in this thread with a link to the new topic.\n\nThe BC Staff\n\n- [![Back to top of page button](https:\/\/www.bleepstatic.com\/skin_images\/bc\/post_top.png) Back to top](https:\/\/www.bleepingcomputer.com\/forums\/t\/814189\/suspected-scam-andor-rat-help-needed\/#ipboard_body \"<img alt=\\\"Back to top of page button\\\" src=\\\"\/\/www.bleepstatic.com\/skin_images\/bc\/post_top.png\\\"> Back to top\")\n***","meta_canonical":null}

3. Robots.txt Check

Query:

Response:

4. Spam/Ban Check

Query:

Response:

5. Seen Status Check

ℹ️ Skipped - page is already crawled

📄

INDEXABLE

✅

CRAWLED

21 days ago

🤖

ROBOTS ALLOWED

Page Info Filters

Filter	Status	Condition	Details
HTTP status	PASS	`download_http_code = 200`	HTTP 200
Age cutoff	PASS	`download_stamp > now() - 6 MONTH`	0.7 months ago
History drop	PASS	`isNull(history_drop_reason)`	No drop reason
Spam/ban	PASS	`fh_dont_index != 1 AND ml_spam_score = 0`	ml_spam_score=0
Canonical	PASS	`meta_canonical IS NULL OR = '' OR = src_unparsed`	Not set

Page Details

Property	Value
URL	https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/
Last Crawled	2026-03-18 01:17:24 (21 days ago)
First Indexed	not set
HTTP Status Code	200
Meta Title	Suspected Scam and/or RAT Help needed - Anti-Virus, Anti-Malware, and Privacy Software
Meta Description	Suspected Scam and/or RAT Help needed - posted in Anti-Virus, Anti-Malware, and Privacy Software: Mod: Please delete. Moved to another thread after seeing that this forum is closed About a month ago my desktop pc (Windows 10) must have been hacked. I woke up one morning, noticed that while I was asleep, my browser (chrome) had visited Paypal with several attempted purchases of gift cards or crypto. They had also visited my gmail and moved the paypal log-in confirmation emails etc. t...
Meta Canonical	null
Boilerpipe Text	#1 GWC71 Members 12 posts OFFLINE Local time: 09:17 PM Posted 04 March 2026 - 01:42 PM Mod: Please delete. Moved to another thread after seeing that this forum is closed About a month ago my desktop pc (Windows 10) must have been hacked. I woke up one morning, noticed that while I was asleep, my browser (chrome) had visited Paypal with several attempted purchases of gift cards or crypto. They had also visited my gmail and moved the paypal log-in confirmation emails etc. to the trash - trying to cover their tracks (but forgot to delete the trash). I immidiately called paypal, none of the purchases were successful but I changed my password and that of my gmail etc. as well. I also updated my chrome browser and ran my installed security programs (RogueKiller, Malwarebytes, SuperAntiSpyware), which found nothing. I did't see any suspiscious activity for several weeks, figured maybe the browser update may have fixed a security hole. Then the other evening I noticed my desktop screensaver had gone off and there was a blue window open on my desktop with the word "Support". I could see a mouse curser moving around, obviously a remote hack. I instantly shut the power off to the pc, unplugged my modem and restarted the pc. While waiting for it to reboot my phone alerted me to email from Paypal (regarding an email password change) and also got a phone text message (2 factor authentication) from paypal with an password reset access code. Once the pc booted, I kept internet off and opened chrome to see if I could get the history. There was evidence of an attempt to access my paypal (unsuccessful) and no evidence of someone messing around in my gmail. After this, I ran those basic av scans and added ESET online scan which identified an old program (utorrent - removed) and a potential trojan (I believe it was part of Microsoft visual ++) Now I just checked a lesser used email account (Not the account from the paypal issues) and found a "ransome note" in my junk folder from "myself" (that lesser used account) from Tuesday, which I can copy and paste here if needed. I'm assuming all of these issues are connected and it sounds serious to me. Is there a way to find and get rid of whatever this is? I'm not tech savy enough to understand anything like this and could really use some help. Thanks! Edited by quietman7, 04 March 2026 - 05:40 PM. Back to top BC AdBot (Login to Remove) BleepingComputer.com Register to remove ads #2 quietman7 quietman7 Bleepin' Gumshoe Global Moderator 65,698 posts OFFLINE Gender: Male Location: Virginia, USA Local time: 09:17 PM Posted 04 March 2026 - 05:40 PM From what you describe you are probably dealing with some sort of tech support scam and hacking. You may want to read Beware of Phony Emails, Phone Calls, Tech Support Scams (Post #13) for more information about how these scams work. Actual ransomware usually will have obvious indications ( signs of infection or signs of ransomware activity ) that something is wrong...it typically targets and encrypts data files so you cannot open them locally (and on any connected drives at the time of infection), in most cases it appends an obvious extension (may be random random or with an id and/or email address) to the end or beginning of encrypted filenames, demands a ransom payment by dropping ransom notes in every directory or affected folder where data has been encrypted and sometimes changes Windows wallpaper. In rare cases the criminals will send victims an email with the ransom demands as reported here . If you need individual assistance from our experts with finding/removing a possible malware infection, checking for possible hacking or just need a second opinion, there are advanced tools which can be used to investigate but they are not permitted in this forum . If you need such help, please follow the instructions in the Malware Removal and Log Section Preparation Guide . After doing that, they should start a new topic and post their FRST logs in the Virus, Trojan, Spyware, and Malware Removal Logs Forum , NOT here , for assistance by the Malware Response Team. If you choose to follow the above instructions, please reply back in this thread with a link to the new topic. The BC Staff Back to top
Markdown	- [![Log in with Twitter](https://www.bleepingcomputer.com/forums/public/style_images/master/loginmethods/twitter.png)](https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter) [Sign In](https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login "Sign In") - [Create Account](https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register "Create Account") [![Logo](https://www.bleepstatic.com/logo/forum-logo.png)](https://www.bleepingcomputer.com/ "Go to community index") - [View New Content](https://www.bleepingcomputer.com/forums/index.php?app=core&module=search&do=viewNewContent&search_app=forums) - [Forum Rules](https://www.bleepingcomputer.com/forum-rules/) - [BleepingComputer.com](https://www.bleepingcomputer.com/ "Homepage") - [Forums](https://www.bleepingcomputer.com/forums/ "Go to Forums") - [Members](https://www.bleepingcomputer.com/forums/members/ "Go to Members") - [Tutorials](https://www.bleepingcomputer.com/tutorials/ "Computer Tutorials") - [Startup List](https://www.bleepingcomputer.com/startups/ "Startup Database") - [Virus Removal](https://www.bleepingcomputer.com/virus-removal/ "Virus Removal Guides") - [Downloads](https://www.bleepingcomputer.com/download/ "Downloads") - [Uninstall List](https://www.bleepingcomputer.com/uninstall/ "Uninstall List") - [Welcome Guide](https://www.bleepingcomputer.com/welcome-guide/ "Welcome Guide") - [More ![Options arrow](https://www.bleepingcomputer.com/forums/public/style_images/master/useropts_arrow.png)](https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/) 1. [BleepingComputer Forums](https://www.bleepingcomputer.com/forums/) 2. → [Security](https://www.bleepingcomputer.com/forums/f/79/security/ "Return to Security") 3. → [Anti-Virus, Anti-Malware, and Privacy Software](https://www.bleepingcomputer.com/forums/f/25/anti-virus-anti-malware-and-privacy-software/ "Return to Anti-Virus, Anti-Malware, and Privacy Software") Javascript Disabled Detected You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality. Register a free account to unlock additional features at BleepingComputer.com Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site. [Click here to Register a free account now\!](https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register) or read our [Welcome Guide](https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/%0Ahttps://www.bleepingcomputer.com/welcome-guide/) to learn how to use this site. Latest News: [Apple pushes first Background Security Improvements update to fix WebKit flaw](https://www.bleepingcomputer.com/news/security/apple-pushes-first-background-security-improvements-update-to-fix-webkit-flaw/) Featured Deal: [One app, every AI model: 1min.AI is now on lifetime deal](https://www.bleepingcomputer.com/offer/deals/one-app-every-ai-model-1minai-is-now-on-lifetime-deal/) Latest Buyer's Guide: [Best VPNs in 2025](https://www.bleepingcomputer.com/vpn/guides/best-vpn/) ![Generic User Avatar](https://www.bleepingcomputer.com/forums/public/style_images/master/profile/default_large.png) # Suspected Scam and/or RAT Help needed Started by GWC71 , Mar 04 2026 01:42 PM - Please log in to reply 1 reply to this topic ### [\#1 ![](https://www.bleepingcomputer.com/forums/public/style_images/master/icon_share.png)](https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/#entry5844281 "Suspected Scam and/or RAT Help needed: post #1") GWC71 GWC71 - ![ Avatar image](https://www.bleepingcomputer.com/forums/public/style_images/master/profile/default_large.png) - Members - 12 posts - OFFLINE - Local time:09:17 PM Posted 04 March 2026 - 01:42 PM Mod: Please delete. Moved to another thread after seeing that this forum is closed About a month ago my desktop pc (Windows 10) must have been hacked. I woke up one morning, noticed that while I was asleep, my browser (chrome) had visited Paypal with several attempted purchases of gift cards or crypto. They had also visited my gmail and moved the paypal log-in confirmation emails etc. to the trash - trying to cover their tracks (but forgot to delete the trash). I immidiately called paypal, none of the purchases were successful but I changed my password and that of my gmail etc. as well. I also updated my chrome browser and ran my installed security programs (RogueKiller, Malwarebytes, SuperAntiSpyware), which found nothing. I did't see any suspiscious activity for several weeks, figured maybe the browser update may have fixed a security hole. Then the other evening I noticed my desktop screensaver had gone off and there was a blue window open on my desktop with the word "Support". I could see a mouse curser moving around, obviously a remote hack. I instantly shut the power off to the pc, unplugged my modem and restarted the pc. While waiting for it to reboot my phone alerted me to email from Paypal (regarding an email password change) and also got a phone text message (2 factor authentication) from paypal with an password reset access code. Once the pc booted, I kept internet off and opened chrome to see if I could get the history. There was evidence of an attempt to access my paypal (unsuccessful) and no evidence of someone messing around in my gmail. After this, I ran those basic av scans and added ESET online scan which identified an old program (utorrent - removed) and a potential trojan (I believe it was part of Microsoft visual ++) Now I just checked a lesser used email account (Not the account from the paypal issues) and found a "ransome note" in my junk folder from "myself" (that lesser used account) from Tuesday, which I can copy and paste here if needed. I'm assuming all of these issues are connected and it sounds serious to me. Is there a way to find and get rid of whatever this is? I'm not tech savy enough to understand anything like this and could really use some help. Thanks\! Edited by quietman7, 04 March 2026 - 05:40 PM. - [![Back to top of page button](https://www.bleepstatic.com/skin_images/bc/post_top.png) Back to top](https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/#ipboard_body "<img alt=\"Back to top of page button\" src=\"//www.bleepstatic.com/skin_images/bc/post_top.png\"> Back to top") * ### BC AdBot (Login to Remove) - ![](https://www.bleepstatic.com/images/site/forum/bots/bot.jpg) - BleepingComputer.com - [Register to remove ads](https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register) * ### [\#2 ![](https://www.bleepingcomputer.com/forums/public/style_images/master/icon_share.png)](https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/#entry5844313 "Suspected Scam and/or RAT Help needed: post #2") quietman7 quietman7 - ![ Avatar image](https://www.bleepingcomputer.com/forums/uploads/profile/photo-thumb-26513.jpg?_r=1738668977) - Global Moderator - 65,698 posts - OFFLINE - Gender:Male - Location:Virginia, USA - Local time:09:17 PM Posted 04 March 2026 - 05:40 PM From what you describe you are probably dealing with some sort of tech support scam and hacking. You may want to read [Beware of Phony Emails, Phone Calls, Tech Support Scams](https://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/?p=3897161) (Post \#13) for more information about how these scams work. Actual ransomware usually will have obvious indications ([signs of infection](https://blog.rsisecurity.com/how-to-identify-signs-of-ransomware-attacks/ "External link") or [signs of ransomware activity](https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-find-ransomware?view=o365-worldwide#check-for-individual-signs-of-ransomware-activity "External link")) that something is wrong...it typically targets and encrypts data files so you cannot open them locally (and on any connected drives at the time of infection), in most cases it appends an obvious extension (may be random random or with an id and/or email address) to the end or beginning of encrypted filenames, demands a ransom payment by dropping ransom notes in every directory or affected folder where data has been encrypted and sometimes changes Windows wallpaper. In rare cases the criminals will send victims an email with the ransom demands as reported [here](https://www.bleepingcomputer.com/news/security/new-agelocker-ransomware-uses-googlers-utility-to-encrypt-files/). If you need individual assistance from our experts with finding/removing a possible malware infection, checking for possible hacking or just need a second opinion, there are advanced tools which can be used to investigate but they are not permitted in this forum. If you need such help, please follow the instructions in the [Malware Removal and Log Section Preparation Guide](https://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/). After doing that, they should start a new topic and post their FRST logs in the [Virus, Trojan, Spyware, and Malware Removal Logs Forum](https://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/), NOT here, for assistance by the Malware Response Team. If you choose to follow the above instructions, please reply back in this thread with a link to the new topic. The BC Staff . . [Microsoft MVP Alumni 2023](https://www.credly.com/badges/de45155a-3505-4de9-99bf-949c61b5132f/linked_in?t=rutxb1 "External link"), Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023 Microsoft MVP Consumer Security 2007-2015 [![kO7xOZh.gif](https://i.imgur.com/kO7xOZh.gif)](https://www.thewindowsclub.com/tips-become-microsoft-mvp-mcc "External link") Member of [UNITE](https://www.allacronyms.com/UNITE/Unified_Network_of_Instructors_and_Trusted_Eliminators "External link"), Unified Network of Instructors and Trusted Eliminators [Retired Police Officer, Federal Agent and Coast Guard Chief](https://www.linkedin.com/in/louis-russell-stamm-iii-742486111/ "External link") If I have been helpful & you'd like to consider a donation, click [![38WxTfO.gif](https://i.imgur.com/38WxTfO.gif)](https://www.paypal.me/quietman7 "External link") - [![Back to top of page button](https://www.bleepstatic.com/skin_images/bc/post_top.png) Back to top](https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/#ipboard_body "<img alt=\"Back to top of page button\" src=\"//www.bleepstatic.com/skin_images/bc/post_top.png\"> Back to top") * * [Back to Anti-Virus, Anti-Malware, and Privacy Software](https://www.bleepingcomputer.com/forums/f/25/anti-virus-anti-malware-and-privacy-software/) - [![twitter share button](https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/twitter.png)](https://www.bleepingcomputer.com/forums/index.php?sharelink=twitter;aHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vZm9ydW1zL3QvODE0MTg5L3N1c3BlY3RlZC1zY2FtLWFuZG9yLXJhdC1oZWxwLW5lZWRlZC8,;U3VzcGVjdGVkIFNjYW0gYW5kL29yIFJBVCBIZWxwIG5lZWRlZA,, "Share this link via Twitter") - [![digg share button](https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/digg.png)](https://www.bleepingcomputer.com/forums/index.php?sharelink=digg;aHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vZm9ydW1zL3QvODE0MTg5L3N1c3BlY3RlZC1zY2FtLWFuZG9yLXJhdC1oZWxwLW5lZWRlZC8,;U3VzcGVjdGVkIFNjYW0gYW5kL29yIFJBVCBIZWxwIG5lZWRlZA,, "Share this link via Digg") - [![delicious share button](https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/delicious.png)](https://www.bleepingcomputer.com/forums/index.php?sharelink=delicious;aHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vZm9ydW1zL3QvODE0MTg5L3N1c3BlY3RlZC1zY2FtLWFuZG9yLXJhdC1oZWxwLW5lZWRlZC8,;U3VzcGVjdGVkIFNjYW0gYW5kL29yIFJBVCBIZWxwIG5lZWRlZA,, "Share this link via Del.icio.us") - [![reddit share button](https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/reddit.png)](https://www.bleepingcomputer.com/forums/index.php?sharelink=reddit;aHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vZm9ydW1zL3QvODE0MTg5L3N1c3BlY3RlZC1zY2FtLWFuZG9yLXJhdC1oZWxwLW5lZWRlZC8,;U3VzcGVjdGVkIFNjYW0gYW5kL29yIFJBVCBIZWxwIG5lZWRlZA,, "Share this link via Reddit") - [![stumble share button](https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/stumble.png)](https://www.bleepingcomputer.com/forums/index.php?sharelink=stumble;aHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vZm9ydW1zL3QvODE0MTg5L3N1c3BlY3RlZC1zY2FtLWFuZG9yLXJhdC1oZWxwLW5lZWRlZC8,;U3VzcGVjdGVkIFNjYW0gYW5kL29yIFJBVCBIZWxwIG5lZWRlZA,, "Share this link via StumbleUpon") - [![print share button](https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/print.png)](https://www.bleepingcomputer.com/forums/index.php?sharelink=print;aHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vZm9ydW1zL3QvODE0MTg5L3N1c3BlY3RlZC1zY2FtLWFuZG9yLXJhdC1oZWxwLW5lZWRlZC8,;U3VzcGVjdGVkIFNjYW0gYW5kL29yIFJBVCBIZWxwIG5lZWRlZA,, "Print") - [![download share button](https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/download.png)](https://www.bleepingcomputer.com/forums/index.php?sharelink=download;aHR0cHM6Ly93d3cuYmxlZXBpbmdjb21wdXRlci5jb20vZm9ydW1zL3QvODE0MTg5L3N1c3BlY3RlZC1zY2FtLWFuZG9yLXJhdC1oZWxwLW5lZWRlZC8,;U3VzcGVjdGVkIFNjYW0gYW5kL29yIFJBVCBIZWxwIG5lZWRlZA,, "Download") #### 2 user(s) are reading this topic 0 members, 2 guests, 0 anonymous users Reply to quoted posts [Clear](https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/ "Clear the posts you have selected with MultiQuote") 1. [BleepingComputer Forums](https://www.bleepingcomputer.com/forums/) 2. → [Security](https://www.bleepingcomputer.com/forums/f/79/security/ "Return to Security") 3. → [Anti-Virus, Anti-Malware, and Privacy Software](https://www.bleepingcomputer.com/forums/f/25/anti-virus-anti-malware-and-privacy-software/ "Return to Anti-Virus, Anti-Malware, and Privacy Software") 4. [Privacy Policy](https://www.bleepingcomputer.com/privacy/) 5. [Rules](http://www.bleepingcomputer.com/forum-rules/) · [![Go to top of page image](https://www.bleepingcomputer.com/forums/public/style_images/master/top.png)](https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/#top "Go to top") - ![RSS Feed](https://www.bleepingcomputer.com/forums/public/style_images/master/feed.png) - [Help](https://www.bleepingcomputer.com/forums/index.php?app=core&module=help "View help") \| \| \|---\| \| [Advertise](https://www.bleepingcomputer.com/advertise/) \\| [About Us](https://www.bleepingcomputer.com/about/) \\| [Terms of Use](https://www.bleepingcomputer.com/terms-of-use/) \\| [Privacy Policy](https://www.bleepingcomputer.com/privacy/) \\| [Sitemap](https://www.bleepingcomputer.com/sitemap/) \\| [Chat](https://www.bleepingcomputer.com/forums/t/730914/the-bleepingcomputer-official-discord-chat-server-come-join-the-fun/) \\| [RSS Feeds](https://www.bleepingcomputer.com/rss-feeds/) \\| [Contact Us](https://www.bleepingcomputer.com/contact/) \| \| [Tech Support Forums](https://www.bleepingcomputer.com/forums/) \\| [Virus Removal Guides](https://www.bleepingcomputer.com/virus-removal/) \\| [Downloads](https://www.bleepingcomputer.com/download/) \\| [Tutorials](https://www.bleepingcomputer.com/tutorials/) \\| [The Computer Glossary](https://www.bleepingcomputer.com/glossary/) \\| [Uninstall List](https://www.bleepingcomputer.com/uninstall/) \\| [Startups](https://www.bleepingcomputer.com/startups/) \| © 2004-2026 All Rights Reserved [Bleeping Computer LLC](https://www.bleepingcomputer.com/) . [Site Changelog](https://www.bleepingcomputer.com/changelog/) [Community Forum Software by IP.Board](http://www.invisionpower.com/apps/board/ "Community Forum Software by Invision Power Services")
Readable Markdown	### [\#1 ![](https://www.bleepingcomputer.com/forums/public/style_images/master/icon_share.png)](https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/#entry5844281 "Suspected Scam and/or RAT Help needed: post #1") GWC71 - ![ Avatar image](https://www.bleepingcomputer.com/forums/public/style_images/master/profile/default_large.png) - Members - 12 posts - OFFLINE - Local time:09:17 PM Posted 04 March 2026 - 01:42 PM Mod: Please delete. Moved to another thread after seeing that this forum is closed About a month ago my desktop pc (Windows 10) must have been hacked. I woke up one morning, noticed that while I was asleep, my browser (chrome) had visited Paypal with several attempted purchases of gift cards or crypto. They had also visited my gmail and moved the paypal log-in confirmation emails etc. to the trash - trying to cover their tracks (but forgot to delete the trash). I immidiately called paypal, none of the purchases were successful but I changed my password and that of my gmail etc. as well. I also updated my chrome browser and ran my installed security programs (RogueKiller, Malwarebytes, SuperAntiSpyware), which found nothing. I did't see any suspiscious activity for several weeks, figured maybe the browser update may have fixed a security hole. Then the other evening I noticed my desktop screensaver had gone off and there was a blue window open on my desktop with the word "Support". I could see a mouse curser moving around, obviously a remote hack. I instantly shut the power off to the pc, unplugged my modem and restarted the pc. While waiting for it to reboot my phone alerted me to email from Paypal (regarding an email password change) and also got a phone text message (2 factor authentication) from paypal with an password reset access code. Once the pc booted, I kept internet off and opened chrome to see if I could get the history. There was evidence of an attempt to access my paypal (unsuccessful) and no evidence of someone messing around in my gmail. After this, I ran those basic av scans and added ESET online scan which identified an old program (utorrent - removed) and a potential trojan (I believe it was part of Microsoft visual ++) Now I just checked a lesser used email account (Not the account from the paypal issues) and found a "ransome note" in my junk folder from "myself" (that lesser used account) from Tuesday, which I can copy and paste here if needed. I'm assuming all of these issues are connected and it sounds serious to me. Is there a way to find and get rid of whatever this is? I'm not tech savy enough to understand anything like this and could really use some help. Thanks\! Edited by quietman7, 04 March 2026 - 05:40 PM. - [![Back to top of page button](https://www.bleepstatic.com/skin_images/bc/post_top.png) Back to top](https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/#ipboard_body "<img alt=\"Back to top of page button\" src=\"//www.bleepstatic.com/skin_images/bc/post_top.png\"> Back to top") * ### BC AdBot (Login to Remove) - ![](https://www.bleepstatic.com/images/site/forum/bots/bot.jpg) - BleepingComputer.com - [Register to remove ads](https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register) * ### [\#2 ![](https://www.bleepingcomputer.com/forums/public/style_images/master/icon_share.png)](https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/#entry5844313 "Suspected Scam and/or RAT Help needed: post #2") quietman7 quietman7 - ![ Avatar image](https://www.bleepingcomputer.com/forums/uploads/profile/photo-thumb-26513.jpg?_r=1738668977) - Global Moderator - 65,698 posts - OFFLINE - Gender:Male - Location:Virginia, USA - Local time:09:17 PM Posted 04 March 2026 - 05:40 PM From what you describe you are probably dealing with some sort of tech support scam and hacking. You may want to read [Beware of Phony Emails, Phone Calls, Tech Support Scams](https://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/?p=3897161) (Post \#13) for more information about how these scams work. Actual ransomware usually will have obvious indications ([signs of infection](https://blog.rsisecurity.com/how-to-identify-signs-of-ransomware-attacks/ "External link") or [signs of ransomware activity](https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-find-ransomware?view=o365-worldwide#check-for-individual-signs-of-ransomware-activity "External link")) that something is wrong...it typically targets and encrypts data files so you cannot open them locally (and on any connected drives at the time of infection), in most cases it appends an obvious extension (may be random random or with an id and/or email address) to the end or beginning of encrypted filenames, demands a ransom payment by dropping ransom notes in every directory or affected folder where data has been encrypted and sometimes changes Windows wallpaper. In rare cases the criminals will send victims an email with the ransom demands as reported [here](https://www.bleepingcomputer.com/news/security/new-agelocker-ransomware-uses-googlers-utility-to-encrypt-files/). If you need individual assistance from our experts with finding/removing a possible malware infection, checking for possible hacking or just need a second opinion, there are advanced tools which can be used to investigate but they are not permitted in this forum. If you need such help, please follow the instructions in the [Malware Removal and Log Section Preparation Guide](https://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/). After doing that, they should start a new topic and post their FRST logs in the [Virus, Trojan, Spyware, and Malware Removal Logs Forum](https://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/), NOT here, for assistance by the Malware Response Team. If you choose to follow the above instructions, please reply back in this thread with a link to the new topic. The BC Staff - [![Back to top of page button](https://www.bleepstatic.com/skin_images/bc/post_top.png) Back to top](https://www.bleepingcomputer.com/forums/t/814189/suspected-scam-andor-rat-help-needed/#ipboard_body "<img alt=\"Back to top of page button\" src=\"//www.bleepstatic.com/skin_images/bc/post_top.png\"> Back to top") ***
Shard	86 (laksa)
Root Hash	2588408978880255886
Unparsed URL	com,bleepingcomputer!www,/forums/t/814189/suspected-scam-andor-rat-help-needed/ s443