Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Clensing a computer after user allowed scammer access to their computer

Posted on 2016-11-07
6
Medium Priority
?
84 Views
Last Modified: 2016-11-25
I've had quite a few of these over the past few months.  All Windows system. The user gets a persistent webpage directing them to call Microsoft or random phone call where the caller tells them their computer is doing something it shouldn't.  Some users go as far to pay the scammer, allow remote access, etc.

When they contact me I'm scanning the drive by removing it from their machine and connecting it to my technical system.  Normally nothing is found.  Diagnosing with their hard drive installed on their machine scanning with Malwarebytes, RogueKiller, check for unwanted programs in add/remove programs, ensure nothing odd in startup under Msconfig.

Any better advice on tools I can use to scan with?

In some instances I've simply saved important user files then reinstalled Windows.   Thanks in advance.
0
Comment
Question by:1namyln
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 7

Expert Comment

by:No More
ID: 41878106
Well, I would definitely check the HOST file for any IP addresses , but to be save system wipe is way to go

Usually it's just some web link with message to contact support etc, always Indian guy on other side  

Additional tools: Spybot  https://www.safer-networking.org    This is really valuable free tool with multiple functions
0
 
LVL 98

Assisted Solution

by:John Hurst
John Hurst earned 500 total points
ID: 41878111
Also, download, install and run Process Explorer from Microsoft. Look under the Explorer tree for any strange alphanumeric processes. If you find any, kill the processes, exit PE and run Malwarebytes again.

If you cannot find anything, you may wish to back up and reinstall anyway just to be on the safe side.
0
 
LVL 88

Accepted Solution

by:
rindi earned 1000 total points
ID: 41878257
It is far better to do a clean re-installation of the OS. Make sure you set it up correctly with a standard account and an Admin account. Users must only use the standard account when using the PC. Change ALL the passwords, including those of email accounts, web-site logins etc. If possible also change the email address. If the user had any of his bank or credit card info etc stored on the PC, have him contact those institutions and recall the cards/change the accounts. Have him get another phone number. Have him change his internet router's password, and if he has a wireless router, also change the wireless WPA2 passphrase.

Although this probably won't be of much use, still have him tell the law enforcement authorities, along with the phone number he called. That may at least get the number blacklisted, or even give the authorities a chance to trace the crooks.
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
LVL 37

Assisted Solution

by:bbao
bbao earned 500 total points
ID: 41878333
if it were me, I would redo everything that the scammer ever touched remotely, not only including all files on the computer, but also the usernames and passwords ever stored on the computer. change all of them, immediately.

however, if the user only received the scamming phone calls or even paid to the scammer but never allowed them to touch user's computer, that should be less critical. however, a security inspection should be conducted on the computer to make sure the redirected web pages were only done by JavaScript when malicious website was visited and not plug-in or ActiveX control or other executable was downloaded and installed. The user's Downloads folder and web browsers' setting can tell the information.
0
 
LVL 1

Author Comment

by:1namyln
ID: 41883274
Clean install is the sure fire way to ensure the problem is no more.  Especially with a user that doesn't have many things to reinstall.  Thanks for the help.
0
 
LVL 88

Expert Comment

by:rindi
ID: 41901326
1namyln,
Please close the Question.
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is a collection of issues that people face from time to time and possible solutions to those issues. I hope you enjoy reading it.
Windows Server 2003 introduced persistent Volume Shadow Copies and made 2003 a must-do upgrade.  Since then, it's been a must-implement feature for all servers doing any kind of file sharing.
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
In this video, viewers are given an introduction to using the Windows 10 Snipping Tool, how to quickly locate it when it's needed and also how make it always available with a single click of a mouse button, by pinning it to the Desktop Task Bar. Int…

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question