• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 88
  • Last Modified:

Clensing a computer after user allowed scammer access to their computer

I've had quite a few of these over the past few months.  All Windows system. The user gets a persistent webpage directing them to call Microsoft or random phone call where the caller tells them their computer is doing something it shouldn't.  Some users go as far to pay the scammer, allow remote access, etc.

When they contact me I'm scanning the drive by removing it from their machine and connecting it to my technical system.  Normally nothing is found.  Diagnosing with their hard drive installed on their machine scanning with Malwarebytes, RogueKiller, check for unwanted programs in add/remove programs, ensure nothing odd in startup under Msconfig.

Any better advice on tools I can use to scan with?

In some instances I've simply saved important user files then reinstalled Windows.   Thanks in advance.
0
1namyln
Asked:
1namyln
3 Solutions
 
No MoreCommented:
Well, I would definitely check the HOST file for any IP addresses , but to be save system wipe is way to go

Usually it's just some web link with message to contact support etc, always Indian guy on other side  

Additional tools: Spybot  https://www.safer-networking.org    This is really valuable free tool with multiple functions
0
 
John HurstBusiness Consultant (Owner)Commented:
Also, download, install and run Process Explorer from Microsoft. Look under the Explorer tree for any strange alphanumeric processes. If you find any, kill the processes, exit PE and run Malwarebytes again.

If you cannot find anything, you may wish to back up and reinstall anyway just to be on the safe side.
0
 
rindiCommented:
It is far better to do a clean re-installation of the OS. Make sure you set it up correctly with a standard account and an Admin account. Users must only use the standard account when using the PC. Change ALL the passwords, including those of email accounts, web-site logins etc. If possible also change the email address. If the user had any of his bank or credit card info etc stored on the PC, have him contact those institutions and recall the cards/change the accounts. Have him get another phone number. Have him change his internet router's password, and if he has a wireless router, also change the wireless WPA2 passphrase.

Although this probably won't be of much use, still have him tell the law enforcement authorities, along with the phone number he called. That may at least get the number blacklisted, or even give the authorities a chance to trace the crooks.
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
bbaoIT ConsultantCommented:
if it were me, I would redo everything that the scammer ever touched remotely, not only including all files on the computer, but also the usernames and passwords ever stored on the computer. change all of them, immediately.

however, if the user only received the scamming phone calls or even paid to the scammer but never allowed them to touch user's computer, that should be less critical. however, a security inspection should be conducted on the computer to make sure the redirected web pages were only done by JavaScript when malicious website was visited and not plug-in or ActiveX control or other executable was downloaded and installed. The user's Downloads folder and web browsers' setting can tell the information.
0
 
1namylnAuthor Commented:
Clean install is the sure fire way to ensure the problem is no more.  Especially with a user that doesn't have many things to reinstall.  Thanks for the help.
0
 
rindiCommented:
1namyln,
Please close the Question.
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now