0

My friend received a call from a person claiming to be a Microsoft tech support representative. This person claimed her laptop was infected with malware and compromised by hackers. He proceeded to manipulate her with technical jargon and persuaded her to install ShowMyPC software on her laptop, at which point he gained remote access onto the laptop. At this point, the man opens notepad and types out protection plans offered by his company called Iyogi. He says that her computer will not be safe unless she pays subscribes to their protection plans. At this point she refuses to pay and he locks her computer from startup. i.e. when you boot the computer you get a prompt for a start-up password before you can get to the Windows 8 user login screen.

I was able to bypass the start-up password using System Restore which restored it to a state before any of this happened. To be safe, I also used Windows 8 Reset feature to format the hard drive and perform a fresh install of Windows from the recovery partition (this is an Asus Windows 8 laptop with a BIOS-embedded product key).

My questions are:

1) Is the computer safe to use now? (Access the internet, log into e-mail, banking etc. Note all passwords were changed for her accounts from a separate computer and a suspicious activity watch was placed on her bank/credit card)

2) Do we need to use anti-virus/malware/rootkit cleaning software? If so, what tools should I use? And can I run it from this computer? or do I need to use separate media?

I am not sure what steps to take next. Any help is appreciated. Thank you.

2
  • You might want to be have her reset/update her passwords.
    – Zoredache
    Aug 28, 2014 at 17:17
  • @Zoredache, we did that, thank you. We are now just paranoid regarding whether the laptop is safe to continue using from now on. Aug 28, 2014 at 23:01

2 Answers 2

1

1) Did you format the drive or roll-back using a restore point? If you formatted the drive you should be safe. If you rolled-back you MIGHT not be safe. In this case, it was a Win8 Reset so the computer should be safe. Run netstat to see what he computer is talking to. If it's talking to computers it shouldn't be you probably still have a problem (which might be solved via Windows Firewall).

2) Yes, you should probably run one of the "remove rootkit" programs. Malware bytes has a free one in beta that came up at the top of my Google Search. There are probably several other options. I've never used one so I can't personally vouch for them. Make sure Windows Firewall is setup and on. If netstat found any network activity that shouldn't be happening use the firewall to block it.

2
  • 1) I formatted the system using Windows Reset (see here: superuser.com/questions/492792/…). So it seems like it was a proper format and I should be safe, right? 2) I will try malwarebytes. Thanks Aug 28, 2014 at 22:59
  • Yes, a reset should do the trick. I've updated the answer. Aug 29, 2014 at 12:23
1

I'm glad to hear that all of her passwords were changed from a separate computer! As for the tools, I would download the free version of Malwarebytes and run a scan. It will ask if you would like a trial of the pro version, but the free version works just fine. I would also download and run TDSSKiller to find any rootkits.

This can all be done on her computer since you said that you formatted the hard drive and did a fresh install. Be sure to install some sort of antivirus on her computer. There are many free options such as Avast that work well. Malwarebytes is also great, but you have to manually run it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .