![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
Hey guys,
So I'm setting up a new pc. It had a fairly fresh windows install (as it got breached somehow a few weeks back) It's mostly used for media consumption, so there wasn't anything important on there. So I just blew out the OS and reinstalled from scratch. I'm guessing my IP was somehow out there, as i was using the windows RDP protocol to connect with the default port.
My assumption was that they just tried that and then got into the machine using an old password (likely breached from somewhere) I don't remember exactly which old password it was.
Anyway, today I'm at work, but I was remoted back into this pc to periodically update drivers etc. I have since changed the default port for RDP to something wacky so that it's not the default. I removed a Microsoft user account today, and went back to only a local account. All of a sudden, my remote session said "your password for this login is invalid" or something to that effect. I closed out the RDP session and reopened it, and the password for the remaining user account doesn't work (I know it's correct, unless it's been changed) I wasn't able to connect via RDP.
I also have chrome remote desktop installed on this machine, so I used that to connect, and tried to login to the only account, and was met with the same "your password is not valid" message. To me, that sounds like someone has logged in and changed the password, but I've no idea how. The only things installed on the machine are nvidia drivers, steam, and the battle.net client, and google chrome.
Since I couldn't get in, I shut the computer down remotely. I won't be able to access it until I get home later, but I'm a little bit freaked out that someone could breach the system AGAIN, especially after I changed the RDP port to something so random.
Can anyone help me figure out what the hell might be going on here? I'm thoroughly confused.
Thanks
So I'm setting up a new pc. It had a fairly fresh windows install (as it got breached somehow a few weeks back) It's mostly used for media consumption, so there wasn't anything important on there. So I just blew out the OS and reinstalled from scratch. I'm guessing my IP was somehow out there, as i was using the windows RDP protocol to connect with the default port.
My assumption was that they just tried that and then got into the machine using an old password (likely breached from somewhere) I don't remember exactly which old password it was.
Anyway, today I'm at work, but I was remoted back into this pc to periodically update drivers etc. I have since changed the default port for RDP to something wacky so that it's not the default. I removed a Microsoft user account today, and went back to only a local account. All of a sudden, my remote session said "your password for this login is invalid" or something to that effect. I closed out the RDP session and reopened it, and the password for the remaining user account doesn't work (I know it's correct, unless it's been changed) I wasn't able to connect via RDP.
I also have chrome remote desktop installed on this machine, so I used that to connect, and tried to login to the only account, and was met with the same "your password is not valid" message. To me, that sounds like someone has logged in and changed the password, but I've no idea how. The only things installed on the machine are nvidia drivers, steam, and the battle.net client, and google chrome.
Since I couldn't get in, I shut the computer down remotely. I won't be able to access it until I get home later, but I'm a little bit freaked out that someone could breach the system AGAIN, especially after I changed the RDP port to something so random.
Can anyone help me figure out what the hell might be going on here? I'm thoroughly confused.
Thanks